create-hook
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to generate and execute shell and Node.js scripts as part of a 'Test & validate' workflow to ensure newly created hooks function correctly.
- [PERSISTENCE]: The skill is designed to create executable scripts in
~/.claude/hooks/or.claude/hooks/and modifysettings.jsonto register these scripts. This allows for automated code execution at specific lifecycle points in future sessions. - [PRIVILEGE_ESCALATION]: The workflow includes granting execution permissions to generated scripts using
chmod +xto ensure they can be invoked by the platform's hook runner. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project data to make decisions:
- Ingestion points: Project configuration files including
package.json,tsconfig.json,.prettierrc, and.eslintrc.*. - Boundary markers: Absent; the skill scans for patterns without explicit delimiting of external data.
- Capability inventory: The skill has the ability to write files, create directories, modify permissions, and execute shell commands.
- Sanitization: Instructions do not specify sanitization or validation of the content discovered in project configuration files.
Audit Metadata