hook-creator

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script resources/scripts/hook-template-generator.js generates Node.js executable files by interpolating user-provided command-line arguments into code templates. This utility is designed to streamline the local creation and configuration of Claude Code hooks.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of automation hooks that ingest and process untrusted input from the agent environment.
  • Ingestion points: Hook templates in the resources/templates/ directory read input data from stdin using fs.readFileSync(0, 'utf-8').
  • Boundary markers: The skill documentation provides explicit advice to treat all hook input as untrusted, although the templates rely on the implementer to define specific validation logic.
  • Capability inventory: The generated hooks possess full Node.js file system and process execution capabilities, which are necessary for their function of intercepting and validating agent tool operations like Bash, Read, and Write.
  • Sanitization: The provided templates include example regex patterns for sanitizing input, such as logic to block recursive force deletion commands, sudo execution, and system directory modifications.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 11:05 AM