disler-hooks-tts

The notification.py hook processes user-provided messages and incorporates them into TTS announcements. While the current implementation only uses predefined messages, the structure accepts arbitrary message content from input_data.get('message') and could be extended to process user content. The hook lacks explicit data boundary markers around user content references, creating potential for instruction injection if the message processing is expanded.

The notification hook constructs shell commands using environment variables (ENGINEER_NAME) and executes subprocess calls with uv run. While ENGINEER_NAME is used in string formatting for TTS messages, the broader pattern of executing shell commands with environment-derived content creates a parameter injection surface. An attacker who can control environment variables could potentially inject additional parameters or alter command execution.

The skill grants extensive bash permissions including 'Bash(chmod:*)' which allows arbitrary file permission modifications. Multiple hook scripts are executed automatically at various lifecycle events (PreToolUse, PostToolUse, SessionStart, etc.) with these elevated permissions. This creates a concrete attack surface where malicious hook scripts could modify file permissions system-wide.

The notification hook script accesses environment variables (ELEVENLABS_API_KEY, OPENAI_API_KEY, ENGINEER_NAME) and executes external TTS scripts. While the current implementation appears to only read these variables, the broad bash permissions combined with automatic hook execution could enable system-level modifications if the hook scripts were compromised or modified.

The skill contains multiple conditional statements that reference system environment variables and state that users wouldn't anticipate. The notification.py script uses conditional logic based on ENGINEER_NAME environment variable and random probability (30% chance) to modify behavior. The get_tts_script_path() function conditionally selects TTS providers based on API key environment variables (ELEVENLABS_API_KEY, OPENAI_API_KEY) without documenting this behavior in the skill's declared scope.

The notification hook implements persistent TTS behavior that announces 'Your agent needs your input' across all sessions without explicit termination conditions or scope boundaries. The behavior persists beyond individual tasks and affects all future agent interactions.

The skill extensively uses 'uv run' commands to execute Python scripts with dependencies specified inline via script metadata, but these dependencies are not declared in the skill's dependency list. Multiple scripts use packages like 'python-dotenv' that are installed at runtime without being in the declared dependencies.