disler-hooks-tts

The notification.py hook processes user-provided messages and incorporates them into TTS announcements. While the current implementation only uses predefined messages, the structure accepts arbitrary message content from input_data.get('message') and could be extended to process user content. The hook lacks explicit data boundary markers around user content references, creating potential for instruction injection if the message processing is expanded.

Several hooks execute shell commands using subprocess.run with user-controlled parameters. The notification.py hook executes TTS scripts with user-provided message content as arguments, and other hooks execute uv commands with paths that could be influenced by user input through environment variables like $CLAUDE_PROJECT_DIR. While some validation exists in permission_request.py for safe bash commands, the actual execution paths in hooks don't consistently apply these protections.

The skill grants extensive bash permissions including 'Bash(chmod:*)' which allows arbitrary file permission modifications. Multiple hook scripts are executed automatically at various lifecycle events (PreToolUse, PostToolUse, SessionStart, etc.) with these elevated permissions. This creates a concrete attack surface where malicious hook scripts could modify file permissions system-wide.

The notification hook script accesses environment variables (ELEVENLABS_API_KEY, OPENAI_API_KEY, ENGINEER_NAME) and executes external TTS scripts. While the current implementation appears to only read these variables, the broad bash permissions combined with automatic hook execution could enable system-level modifications if the hook scripts were compromised or modified.

The skill contains multiple conditional statements that reference system environment variables and state that users wouldn't anticipate. The notification.py script uses conditional logic based on ENGINEER_NAME environment variable and random probability (30% chance) to modify behavior. The get_tts_script_path() function conditionally selects TTS providers based on API key environment variables (ELEVENLABS_API_KEY, OPENAI_API_KEY) without documenting this behavior in the skill's declared scope.

The notification hook implements persistent TTS behavior that announces 'Your agent needs your input' across all sessions without explicit termination conditions or scope boundaries. The behavior persists beyond individual tasks and affects all future agent interactions.

The skill extensively uses 'uv run' commands to execute Python scripts with dependencies specified inline via script metadata, but these dependencies are not declared in the skill's dependency list. Multiple scripts use packages like 'python-dotenv' that are installed at runtime without being in the declared dependencies.