The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill provides templates and instructions for modifying the ~/.claude/settings.json configuration file to define arbitrary shell commands under the hooks key. These commands execute automatically when specific tools are used or events occur, creating a persistent execution mechanism.
[REMOTE_CODE_EXECUTION] (HIGH): The provided templates promote unsafe shell interpolation of environment variables. Specifically, the notification example uses $CLAUDE_MESSAGE inside an osascript call, and the logging example suggests using tool outputs. Since these variables contain untrusted data generated by the LLM or external sources, an attacker could trigger command injection.
[INDIRECT_PROMPT_INJECTION] (HIGH): The skill exposes a significant attack surface by ingesting untrusted data (tool inputs/outputs) and feeding them directly into executable shell contexts.
Ingestion points: references/claude-hook.template.md identifies $CLAUDE_TOOL_INPUT, $CLAUDE_TOOL_OUTPUT, and $CLAUDE_MESSAGE as data sources.
Boundary markers: None present in the templates to separate data from commands.
Capability inventory: The type: command hook allows for arbitrary subprocess execution.
Sanitization: No sanitization or escaping is mentioned or implemented in the examples, leading to high-risk command injection patterns.

claude-hooks