hook-development

This is a readable hook-testing helper, not evident malware: it validates JSON, runs a selected hook, and reports its output. However, unquoted interpolation into bash -c permits shell command injection through crafted hook or input paths, and an inherited CLAUDE_ENV_FILE path is read and deleted if it exists. No domains, URLs, IP addresses, or specific credential targets are present. Severity is moderate because exploitation requires control of arguments or environment values, and hook execution is an intended feature.

This is a readable command-validation hook, not evidence of malware. It reads a command from stdin and makes an external runner decision, but its narrow string checks and default-allow behavior can let dangerous commands pass; treat it as an inadequate security control (moderate risk), not as a malicious payload. No domains, URLs, IP addresses, credentials, or sensitive file paths are present.