The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The hook script ai-review.sh is vulnerable to indirect prompt injection because it interpolates untrusted tool input directly into the review prompt for Claude Haiku. An attacker could craft a tool input (e.g., in a file edit or a shell command) that contains instructions to the reviewer to always return 'ALLOW', potentially bypassing the intended security check.
Ingestion points: TOOL_INPUT variable in scripts/ai-review.sh, which contains the JSON-formatted arguments of the tool call being reviewed.
Boundary markers: The prompt uses simple text labels (Input: $TOOL_INPUT) but lacks strong delimiters or specific instructions to the AI to ignore embedded commands or instructions within the input data.
Capability inventory: The hook script has the capability to automatically approve (allow) or block (deny) any tool call, including file modifications (Edit, Write) and arbitrary shell commands (Bash).
Sanitization: The script does not perform any sanitization, escaping, or validation of the TOOL_INPUT before including it in the prompt string.
[PERSISTENCE]: The scripts/install.sh script modifies the user's ~/.claude/settings.json file to register a PreToolUse hook. This configuration ensures that the ai-review.sh script is executed automatically by the Claude Code agent for every tool call across future sessions until manually removed.

auto-permissions-review-install