hook-development
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation for the Claude Code platform's hook system, which is used for automation and project governance.
- [PROMPT_INJECTION]: The skill mentions prompt-based hooks that use untrusted data ($TOOL_INPUT). This is a surface for indirect prompt injection.
- Ingestion points: Stdin to hooks containing tool metadata in SKILL.md.
- Boundary markers: Not explicitly defined in examples.
- Capability inventory: Bash script execution and LLM prompting.
- Sanitization: The skill provides examples of sanitizing inputs in bash to prevent path traversal and access to sensitive files.
- [COMMAND_EXECUTION]: The skill describes how to use bash commands within hooks. It includes instructions for safe usage, such as quoting variables and performing security checks on tool names and paths.
Audit Metadata