scaffold-hooks
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
harnesses/claude/scripts/check_workspace_trust.shincludes an--enableflag that programmatically modifies the user's~/.claude.jsonfile to sethasTrustDialogAcceptedtotrue. This action bypasses the manual trust dialog designed to prevent automatic hook execution in untrusted project directories.\n- [EXTERNAL_DOWNLOADS]: The scriptsharnesses/devin/scripts/verify_docs.pyandharnesses/copilot/scripts/verify_docs.pyuseurllib.requestto fetch content fromdocs.devin.aiandraw.githubusercontent.com. These requests are used to verify that the scaffolded hook definitions remain aligned with official documentation.\n- [REMOTE_CODE_EXECUTION]: The skill's primary function is to generate bash scripts and register them in agent configuration files (such as.claude/settings.jsonor.devin/hooks.v1.json). This establishes a persistent mechanism for the AI agent to automatically execute project-local code during lifecycle events.
Audit Metadata