The Agent Skills Directory

Command Execution (HIGH): The skill is designed to configure shell commands that execute automatically on system events (e.g., PreToolUse, PostToolUse). This provides a direct mechanism for arbitrary command execution on the host machine.
Persistence Mechanisms (HIGH): Commands are stored in persistent configuration files (~/.claude/settings.json), allowing malicious logic to survive across different sessions and projects.
Privilege Escalation (HIGH): The documentation for the PermissionRequest event (in references/hook-events.md) explicitly instructs users how to use exit code 2 to auto-approve permission dialogs, effectively bypassing the agent's human-in-the-loop security boundary.
Dynamic Execution (HIGH): The SessionStart example in references/examples.md demonstrates sourcing a local environment file (source .claude-env) without any validation. This allows an attacker to achieve local code execution by placing a malicious .claude-env file in a project directory.
Indirect Prompt Injection (LOW): The Notification hook examples use xargs to interpolate tool-generated messages into shell commands (e.g., osascript -e 'display notification "{}"'). If an attacker can control the message content (e.g., via a subagent output or tool response), they could potentially achieve command injection.
Credentials Exposure (MEDIUM): While some examples suggest blocking access to sensitive files like .env, the skill provides the exact logic needed to read and process these files using jq and python3, which could be easily repurposed for exfiltration.

hook-creator