claude-code-hooks
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: Provides shell script skeletons for Claude Code hooks. These scripts are intended for local execution to gate or modify tool calls. The logic is transparent and follows standard shell scripting patterns using system utilities like python3, grep, and bash.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing untrusted data from tool inputs and model responses.
- Ingestion points: Data enters via the stdin JSON contract for hooks described in SKILL.md and references/hook_patterns.md (e.g., tool_input.command field).
- Boundary markers: Recommends using shlex for token-level parsing and case statements for coarse filtering as seen in the skeletons in SKILL.md.
- Capability inventory: The scripts in references/hook_patterns.md invoke bash, python3, grep, and osascript.
- Sanitization: Employs shlex.shlex class with punctuation_chars=True in references/hook_patterns.md to correctly tokenize shell commands, preventing bypasses via quote splicing or malformed separators.
- [PERSISTENCE]: Documents the standard platform mechanism for registering hooks within the ~/.claude configuration directory. This persistence is required for the intended functionality of the Claude Code toolset.
- [SAFE]: The skill includes extensive documentation on pitfalls and error conditions, demonstrating a high level of security awareness and providing mitigation strategies for common development errors in hook creation. No malicious patterns, data exfiltration, or unauthorized privilege escalation were identified.
Audit Metadata