hook-creator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
resources/scripts/hook-template-generator.jsgenerates Node.js executable files by interpolating user-provided command-line arguments into code templates. This utility is designed to streamline the local creation and configuration of Claude Code hooks. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of automation hooks that ingest and process untrusted input from the agent environment.
- Ingestion points: Hook templates in the
resources/templates/directory read input data from stdin usingfs.readFileSync(0, 'utf-8'). - Boundary markers: The skill documentation provides explicit advice to treat all hook input as untrusted, although the templates rely on the implementer to define specific validation logic.
- Capability inventory: The generated hooks possess full Node.js file system and process execution capabilities, which are necessary for their function of intercepting and validating agent tool operations like Bash, Read, and Write.
- Sanitization: The provided templates include example regex patterns for sanitizing input, such as logic to block recursive force deletion commands, sudo execution, and system directory modifications.
Audit Metadata