trailofbits-hooks

The skill's PreToolUse hooks execute shell commands that directly interpolate user-provided command content without proper sanitization. The hooks use `jq -r '.tool_input.command'` to extract user input and then pass it to shell operations like `echo "$CMD"` and `grep` patterns. An attacker could inject shell metacharacters, command separators, or escape sequences in the tool_input.command field to execute arbitrary commands or bypass the security checks.

The skill's hook system is designed to block dangerous operations like 'rm -rf' and 'git push --force', but the implementation has gaps that could allow bypasses. The hooks use regex patterns that may not catch all variations of dangerous commands, and the configuration explicitly mentions blocking force operations while potentially allowing them through pattern evasion.

The skill implements extensive protections against system boundary violations through permission denies for sensitive directories (~/.ssh, ~/.aws, ~/.config, etc.) and shell profile modifications. However, the protection is implemented as a blacklist which may not cover all possible system configuration paths or new credential storage locations.

The skill contains multiple conditional statements that reference system state the user wouldn't anticipate, including environment variables (CLAUDE_PROJECT_DIR), file system state (pnpm-lock.yaml existence), and command parsing logic that makes decisions based on system context rather than explicit user input.

The skill contains persistent behavioral directives that would affect all future tasks through environment variables and hook configurations. The 'alwaysThinkingEnabled': true setting and environment variables like 'DISABLE_TELEMETRY': '1' establish persistent behavioral changes that extend beyond any single task execution.

The skill creates persistent state through logging mechanisms and configuration files that outlast individual task execution. The GAM logging hook creates persistent audit trails in '.changelog-raw.jsonl' files, and the statusline script reads and processes persistent workspace state.

While the skill appears to be focused on development environment safety (Trail of Bits Hooks), it includes broad system-level permissions management, environment variable manipulation, and comprehensive file system access controls that extend beyond simple hook functionality. The extensive deny permissions list and environment variable settings suggest authority claims that may exceed the stated purpose.

The skill configuration includes extensive bash command execution through hooks and status line scripts, but declares no dependencies in metadata. While the hooks appear to be security-focused (blocking dangerous rm commands, enforcing package manager conventions), the capability to execute arbitrary shell commands through the hook system could potentially be used for undeclared package installations or other system modifications. The statusline.sh script also executes git commands and other system utilities.