semble-setup

This configuration enables high-impact runtime code execution by invoking Node.js scripts at multiple lifecycle points (session start and before Bash/Grep). The most concerning element is the execution of a script from an absolute external path ("/opt/foreign/pre-bash.mjs"), which raises provenance/integrity concerns. Malicious behavior cannot be confirmed from this fragment alone, but the wiring itself is a significant supply-chain risk requiring review of the referenced .mjs scripts and their sources/integrity.

No explicit malware or data-exfiltration logic is present in this fragment, but it establishes event-driven execution of two external Node.js hook scripts from `/opt/foreign/` at sensitive lifecycle points (pre-tool for Bash and broadly on subagent stop). Since the hook script contents are not provided, the primary risk is unreviewed, potentially malicious behavior and/or unintended access to temp files under `//tmp/**`. Treat the external hook scripts as the main trust boundary and verify integrity/behavior before use.