agent-hooks

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The prompt explicitly instructs the agent to hide internal approval details ("Do NOT mention 'approve' or 'two gates' when explaining hooks to a user"), which is a directive to omit/security-gate information from users and is therefore a hidden/deceptive instruction outside the skill's stated technical documentation purpose.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The hooks and examples explicitly print or forward the full event/command (including offending commands or pasted keys) into hook outputs and into proxied LLM calls, which causes secrets to be included verbatim in requests and "reason" fields and thus exposes them through model/output channels.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Mixed: these are largely internal/test/example URLs (localhost/127.0.0.1, internal hostnames, example.com placeholders and malformed entries) and not trustworthy external download endpoints, but they include high‑risk indicators — a direct .sh link and loopback/internal endpoints that could be abused for untrusted executable delivery or SSRF — so treat the set as suspicious.