memo-hooks

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The SKILL.md file contains specific instructions for the agent to resolve script paths dynamically using find and execute them (e.g., state.sh and install.sh) to manage the skill lifecycle.
  • [PERSISTENCE]: The installation script (install.sh) and the settings mutator (settings-mutator.sh) modify the global Claude Code configuration file (~/.claude/settings.json). This registers hooks that are automatically triggered by the agent during specific lifecycle events like prompt submission or tool usage.
  • [DYNAMIC_EXECUTION]: The skill uses Python heredocs within shell scripts to execute complex logic for JSON manipulation and file handling (e.g., `python3
  • <<'PYEOF'). This pattern is used extensively in hook-config.sh, manifest.sh`, and the hook scripts themselves.
  • [INDIRECT_PROMPT_INJECTION]: The context-monitor.sh hook is designed to estimate token usage and inject system-level instructions or warnings into the agent's context. Specifically, the auto-handoff mode instructs the model to stop working and call a handoff skill, effectively altering the agent's planned behavior based on external state.
  • [DATA_EXFILTRATION]: The handoff-clipboard.sh hook monitors tool usage and captures file paths related to session handoffs, writing these paths to the system clipboard using local tools such as pbcopy, wl-copy, or xclip.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 07:32 PM