Security audit

Agent Hooks

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local Claude Code hook bundle that can steer agent execution, but I found no hidden exfiltration, destructive behavior, or automatic installation.

Install only if you want local hooks to actively steer Claude Code behavior. Review the scripts first, test with a temporary HOME/session, and be careful enabling Stop hooks or async diagnostics in sensitive repositories because they can block completion and run local developer tools automatically.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes and configures bash hook scripts that read environment variables, invoke shell commands, and write persistent state to session directories, but it does not declare permissions. This mismatch is dangerous because users and enforcement layers may not realize the skill has command execution and filesystem access, reducing transparency and weakening consent and policy controls.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The document expands a retry-mitigation hook into persistent storage of resolved errors across future sessions, which materially broadens data retention and behavioral scope. In an agent-hooks skill, cross-session auto-memory can capture sensitive command output, error text, file paths, tokens, or environment details and reuse them later without clear minimization, consent, or retention controls.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The markdown promotes `updatedInput` as a deterministic way to rewrite tool commands before execution, shifting the hook from advisory guidance into active command mutation. In this context, a hook that silently changes a Bash command can cause unintended package installation or execution paths, undermining operator intent and creating a strong command-injection/unsafe automation risk if the rewrite logic is derived from tool failures or untrusted text.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list contains broad phrases such as 'persistent execution', 'speculative', 'hook scripts', and generic retry/stop wording that could match ordinary conversation. In a skill that installs blocking/intervening hooks, overly broad activation can cause unintended interception of agent workflows, leading to disruptive or unsafe command gating in unrelated contexts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document describes modifying tool input via `updatedInput` without any warning that the hook may change commands or alter system behavior. For an agent execution hook, hidden pre-execution mutation is especially dangerous because users and downstream systems may believe the original command ran, while the hook substituted a different one with different side effects.

Static analysis

No suspicious patterns detected.