creating-hooks
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/update-docs.pyutility fetches markdown documentation from Anthropic's official documentation service atcode.claude.com. The fetched content is saved as static reference files within the skill's directory and is not executed. - [COMMAND_EXECUTION]: The instructions in
SKILL.mdguide the user to execute a local Python script to update reference files. This script performs network operations using the standardrequestslibrary to synchronize documentation. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions on building lifecycle hooks, which ingest data from tool executions and environment context. This creates a potential surface for indirect prompt injection if untrusted data is processed. The skill includes documentation on security best practices, such as input sanitization and quoting variables, to address these risks.
Audit Metadata