story-setup

SUSPICIOUS: the skill’s purpose broadly matches its deployment behavior, but its footprint is very large for a writing setup tool and it explicitly directs transitive installation via the skills CLI. No clear credential theft or exfiltration appears, and the command-injection findings are documentation artifacts, but the wide write/execute surface and transitive trust keep risk at medium.

This module is a lifecycle hook runner that resolves a project root (from env/CWD), locates `.codex/hooks/run-story-hook.sh` (Unix) or `.codex/hooks/run-story-hook.cmd` (Windows), and executes it with the specified event. The snippet shows no explicit data theft or network activity, but it contains a high-impact arbitrary-code-execution pathway driven by repository-local hook content and uses `powershell -ExecutionPolicy Bypass` on Windows, increasing risk if the `.codex/hooks` files can be tampered with.

This fragment is not itself malicious code, but it is a powerful hook dispatcher that repeatedly executes multiple local bash scripts from a hidden project directory (".claude/hooks") based on workflow events. The security risk is primarily contingent on the integrity and provenance of the referenced scripts and the runtime value of "$CLAUDE_PROJECT_DIR". Inspect and verify all .claude/hooks/*.sh contents (and ensure $CLAUDE_PROJECT_DIR cannot be influenced by an attacker).

This snippet is a lifecycle hook configuration that repeatedly executes an internal Node.js script (hooks/story_antigravity_hook.js) at several stages, creating a direct control path for arbitrary host actions with the privileges of the workflow runner. The fragment itself shows no explicit malicious payload, but the overall supply-chain risk is non-trivial because the security-relevant behavior is deferred to an unreviewed script and multiple stages are invoked.