scaffold-hooks

This is a hook scaffolder that validates a plan, generates GitHub Copilot hook files, and arranges for plan-configured commands or scripts to run at hook time. Its shell execution and permissive script/cwd paths are powerful by design and make an untrusted or compromised plan capable of executing arbitrary commands or accessing files available to the process. No direct credential theft, network exfiltration, persistence beyond the generated hooks, or other malicious payload is evident in this excerpt; severity is elevated when plan files are not trusted.