system-audit

This is a hook-auditing utility, not evident malware. Its use of shell=True to execute configured hook commands is consequential: running it on a project with untrusted settings can execute attacker-controlled commands. The simulated force-push input also creates risk if a tested hook executes tool input. The shown split string may prevent execution entirely if literal. Review hook configuration before running.