claude-code-hooks

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: Enables the setup of automated hooks that execute shell commands in response to platform events. Evidence: Hook recipes in references/hook-recipes.md include commands like prettier, black, and curl to automate development workflows.\n- [EXTERNAL_DOWNLOADS]: Hook recipes suggest using tools such as npx prettier or npx eslint, which may fetch resources from public package registries if they are not already installed.\n- [DATA_EXFILTRATION]: Provides a recipe demonstrating how to send event notifications to an external Slack webhook using curl. This is presented as an optional feature for remote alerts and uses user-defined environment variables for destination URLs.\n- [SAFE]: The provided Python scripts for applying hook configurations include protective measures like creating file backups (.json.backup) and using robust JSON merging logic to prevent data loss or corruption in settings files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 06:04 AM
Security Audit — agent-trust-hub — claude-code-hooks