cc-hooks

SUSPICIOUS: the main dispatcher and policy registry are coherent with a hook-configuration skill and show no direct credential theft or network exfiltration, but the skill’s footprint is broadened by transitive install paths, optional third-party tooling, and reference docs for remote SSH routing. This is not confirmed malware, but it carries medium supply-chain and workflow-trust risk beyond the narrow local-hook purpose.

No overtly malicious malware behavior (e.g., backdoor/reverse shell) is evident from the shown fragment. However, it includes a high-value supply-chain/automation security concern: an unredacted exfiltration path where untrusted stdin content is forwarded to an external Slack/Discord webhook URL via `curl`. In addition, the module injects local project context and repository/issue metadata into session outputs and persists environment diffs to `$CLAUDE_ENV_FILE`, which can amplify privacy and confidentiality risk depending on upstream data and downstream logging/LLM handling.

No direct malware behaviors (e.g., network exfiltration, reverse shells, or obfuscated payloads) are present in the visible fragment. The primary security concern is the persistence mechanism that appends environment-variable export statements into a file path controlled by CLAUDE_ENV_FILE, including an API_KEY-style export pattern. Additionally, the described hook framework includes an OS command execution capability (`type:"command"`), which could become dangerous if hook configuration or inputs are not strictly authorized/validated. Overall: higher-than-normal risk due to secret/persistence and command-execution surface, but confirmed malicious code is not evident in the excerpt.

This fragment is an installer that performs persistent configuration changes by installing a bundled policy-dispatcher and policies.json into a Claude hooks directory and then injecting PreToolUse matchers into user/project settings.json using jq. Within this file, there are no direct malicious primitives such as network exfiltration, credential access, or obfuscated payload execution; risk is primarily indirect and deferred to the bundled dispatcher/lint scripts and the policy registry content (not shown). The strongest security concern is that it enables an always-on interception mechanism for Bash (Edit|Write), which could be used for enforcement or for unwanted telemetry/data handling depending on the installed dispatcher implementation.