memo-hooks
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md file contains specific instructions for the agent to resolve script paths dynamically using
findand execute them (e.g.,state.shandinstall.sh) to manage the skill lifecycle. - [PERSISTENCE]: The installation script (
install.sh) and the settings mutator (settings-mutator.sh) modify the global Claude Code configuration file (~/.claude/settings.json). This registers hooks that are automatically triggered by the agent during specific lifecycle events like prompt submission or tool usage. - [DYNAMIC_EXECUTION]: The skill uses Python heredocs within shell scripts to execute complex logic for JSON manipulation and file handling (e.g., `python3
- <<'PYEOF'
). This pattern is used extensively inhook-config.sh,manifest.sh`, and the hook scripts themselves. - [INDIRECT_PROMPT_INJECTION]: The
context-monitor.shhook is designed to estimate token usage and inject system-level instructions or warnings into the agent's context. Specifically, theauto-handoffmode instructs the model to stop working and call a handoff skill, effectively altering the agent's planned behavior based on external state. - [DATA_EXFILTRATION]: The
handoff-clipboard.shhook monitors tool usage and captures file paths related to session handoffs, writing these paths to the system clipboard using local tools such aspbcopy,wl-copy, orxclip.
Audit Metadata