Hooks

Validates hook configuration. The security rules scan hooks in hooks.json, .claude/settings*.json, and skill/agent frontmatter (hooks: key) for supply-chain attack patterns (inspired by the Shai-Hulud attack).

Rule ID	Description	Default Severity	Autofix
hooks-json-valid	hooks.json must be valid JSON with proper hook configuration structure	error	-
hooks-dangerous	Flags hook commands that execute scripts from dotfile directories, download-and-execute chains (curl|sh), obfuscation (eval/base64), or perform network requests	error (auto)	-
hooks-prohibited	All hook commands are prohibited unless explicitly allowlisted; catches new or unexpected hooks added to a project	error (disabled)	-