craft-harness

This snippet itself is a benign-looking hook configuration, but it establishes an automatic `node` execution of a project-local `.mjs` guard script after edit/write-like tool actions. The main security concern is that the executed file’s integrity (and the trustworthiness of $CLAUDE_PROJECT_DIR) entirely determines whether the hook is safe; otherwise it could become an arbitrary code execution vector. Review the contents of `package-manager-guard.mjs` and ensure the execution path cannot be attacker-controlled.