story-setup

No explicit malicious actions are visible in this wrapper, but it functions as an unverified local code execution launcher: it dynamically discovers and runs a filesystem-selected Python hook script at multiple lifecycle stages, including using upward directory traversal and environment-influenced project root selection. Treat this as a notable security risk in threat models where an attacker might be able to drop or tamper with .codex/hooks/story_codex_hook.py or influence CODEX_PROJECT_DIR/CLAUDE_PROJECT_DIR, since the wrapper provides direct arbitrary code execution with the host’s privileges. Further assessment requires inspecting story_codex_hook.py itself.

This file defines a local-bash hook execution framework that will run multiple scripts from a hidden project directory based on workflow events. The snippet itself shows no malicious payloads, credentials, or obfuscation, but it creates an explicit arbitrary command execution sink whose safety depends entirely on the integrity of "$CLAUDE_PROJECT_DIR" and the contents of "$CLAUDE_PROJECT_DIR/.claude/hooks/*.sh". Treat as potentially high workstation/supply-chain risk until those scripts are reviewed and integrity-verified.