Hooks¶
Validates hook configuration. The security rules scan every hook a repository ships — a Claude plugin's hooks/hooks.json and .claude/settings*.json, Codex's .codex/hooks.json, the [hooks] tables of its .codex/config.toml, and plugin hooks, Muse Code's .muse/hooks.json, Grok Build's .grok/hooks/*.json and its plugin hooks, Cursor's .cursor/hooks.json, Google Antigravity's hooks.json in a customization root or plugin, and skill, Claude-agent, and Copilot-agent frontmatter (hooks: key) — for supply-chain attack patterns (inspired by the Shai-Hulud attack).
| Rule ID | Description | Default Severity | Autofix |
|---|---|---|---|
claude-hooks-valid |
Claude Code hooks.json must be valid JSON with proper hook configuration structure | error | - |
hooks-dangerous |
Flags hook commands that chain a download into execution (curl|sh), obfuscate their payload (eval/base64), or perform network requests | error (auto) | - |
hooks-prohibited |
All hooks are prohibited unless explicitly allowlisted; catches new or unexpected hooks added to a project | error (disabled) | - |