Hook Development

Pass

Audited by Gen Agent Trust Hub on Mar 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes scripts/test-hook.sh, a utility designed to execute local shell scripts provided as arguments for testing purposes. This script uses bash -c to pipe test data into the target hook script.
  • [COMMAND_EXECUTION]: The examples/load-context.sh script executes filesystem checks (e.g., looking for package.json, Cargo.toml, pyproject.toml) to detect project types and persist configuration via the $CLAUDE_ENV_FILE environment variable.
  • [EXTERNAL_DOWNLOADS]: The documentation in references/advanced.md provides examples of using curl to send notifications to Slack or metrics to external systems. These are code snippets for reference and are not executed by the skill itself.
  • [DATA_EXFILTRATION]: Example patterns in the documentation demonstrate how to log session metadata or hook outcomes to external databases and audit logs for monitoring purposes.
  • [PROMPT_INJECTION]: The skill provides guidance on creating 'Prompt-Based Hooks'. It includes defensive prompt engineering examples that instruct the model to specifically look for and block malicious activities like path traversal, credential access, and destructive operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 8, 2026, 06:11 AM