duck-tape

This module configures an automated build/packaging lifecycle hook that runs a local PowerShell script via `powershell -File` using a runtime-resolved project path. While no explicit malicious payload is visible in the snippet, the ability to execute a local `.ps1` during `PreCompact`—without any shown integrity checks—creates a meaningful supply-chain/workflow compromise risk. Review and verify the exact `extract-state.ps1` contents and ensure the script path and directory cannot be tampered with before execution.

This configuration enables local shell script execution during a build/lifecycle phase. While the snippet itself shows no explicit malicious payload, it provides a high-leverage supply-chain execution path: bash will run extract-state.sh from a path determined by CLAUDE_PROJECT_DIR, with no shown validation or integrity checking. Review the actual extract-state.sh contents, verify file integrity/ownership, and ensure CLAUDE_PROJECT_DIR cannot be influenced by untrusted actors in the execution environment.

This fragment itself is not malicious code, but it configures a high-impact preCompact lifecycle hook that executes local bash/PowerShell scripts from relative paths. Because the script contents are not provided, any potential data theft/exfiltration or system modification cannot be verified here; however, the arbitrary code execution at lifecycle time is a significant supply-chain security concern that warrants inspection/audit of extract-state.sh and extract-state.ps1 and any network/file/process behavior they perform.