plugin-builder

This is a high-impact lifecycle execution configuration: it will run two packaged shell scripts on every matching `SessionStart` and `Stop` event due to the broad `matcher: .*`. The fragment itself shows no clear malicious indicators (no secrets, no network calls, no obfuscation), but it establishes a direct command execution sink dependent entirely on the integrity and behavior of `./scripts/hooks/session_start_check.sh` and `./scripts/hooks/stop_guard.sh`. Review those scripts for exfiltration, credential access, persistence, and unsafe command execution, since compromise would make this configuration an effective supply-chain payload launcher.