Security Audit

Treat every hook, MCP, and agent capability as high-risk.

Checklist (always cover these)

• Hard-coded secrets or credentials
• Unsafe command execution or shell injection
• Path traversal or arbitrary file access
• Insufficient input validation / sanitization
• Overly broad permissions in MCP servers or hooks
• Trust model for project-provided hooks/skills
• Data exfiltration risks (especially in research or browser MCPs)
• Logging of sensitive information

Process