{
  "capability_id": "johnlindquist-claude-hooks",
  "capability_type": "skill",
  "status": "FINDINGS",
  "methodology_version": "1.0",
  "categories_tested": [
    "prompt_injection_chains",
    "privilege_escalation",
    "data_exfiltration_side_channels",
    "capability_squatting",
    "context_poisoning",
    "dependency_confusion"
  ],
  "test_counts": {
    "patterns_analyzed": 28
  },
  "findings": [
    {
      "id": "ADV-2026-0001",
      "category": "prompt_injection_chains",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Shell command injection through user-controlled file paths and commands",
      "description": "The skill executes shell commands using spawn() with user-provided content that could contain shell metacharacters. Multiple injection points exist: (1) In init.js, the command 'bun .claude/hooks/index.ts' is constructed and executed where user could control the working directory or file contents, (2) The skill runs 'bun init -y' and 'bun add -d @types/node' in user-controlled directories, (3) File paths from user input are used directly in fs operations and command construction without sanitization.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "const child = spawn('bun', ['init', '-y'], { cwd: '.claude/hooks', stdio: 'pipe', shell: false }); ... const child = spawn('bun', ['add', '-d', '@types/node'], { cwd: '.claude/hooks', stdio: 'pipe', shell: false }); ... command: 'bun .claude/hooks/index.ts Notification'",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill executes shell commands using spawn() with user-provided content that could contain shell metacharacters. Multiple injection points exist: (1) In init.js, the command 'bun .claude/hooks/index.ts' is constructed and executed where user could control the working directory or file contents, (2) The skill runs 'bun init -y' and 'bun add -d @types/node' in user-controlled directories, (3) File paths from user input are used directly in fs operations and command construction without sanitization.",
      "recommendation": "Validate and sanitize all user-provided paths and content before using in shell commands. Use absolute paths, validate directory names against allowlists, and escape or reject any content containing shell metacharacters. Consider using safer alternatives to shell execution for file operations.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0002",
      "category": "privilege_escalation",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Skill instructs agent to modify system configuration and install global packages",
      "description": "The skill contains multiple instructions that direct the agent to perform system-level modifications outside the project scope, including global package installation, system PATH modification, and shell profile alterations.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "console.log(chalk.gray('    Install: curl -fsSL https://bun.sh/install | bash')); ... console.error(chalk.cyan('   curl -fsSL https://bun.sh/install | bash')); ... const child = spawn('bun', ['init', '-y'], { ... const child = spawn('bun', ['add', '-d', '@types/node'], {",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill contains multiple instructions that direct the agent to perform system-level modifications outside the project scope, including global package installation, system PATH modification, and shell profile alterations.",
      "recommendation": "Remove instructions for global Bun installation and system modifications. Instead, document these as prerequisites that users must handle themselves, or provide detection-only functionality that warns users about missing dependencies without attempting to install them.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0003",
      "category": "privilege_escalation",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Skill uses force flags and bypasses user confirmation in multiple operations",
      "description": "The skill automatically executes commands with force flags and bypasses user confirmation in several scenarios, including overwriting existing files and running package installations without user interaction.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "const child = spawn('bun', ['init', '-y'], { ... const child = spawn('bun', ['add', '-d', '@types/node'], { ... if (hooksExist && !flags.force) { console.log(chalk.yellow('Claude hooks already exist. Use --force to overwrite.')); return; }",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill automatically executes commands with force flags and bypasses user confirmation in several scenarios, including overwriting existing files and running package installations without user interaction.",
      "recommendation": "Remove automatic force flags from package installation commands. Implement proper user confirmation dialogs for all destructive operations, and ensure the --force flag only applies to file overwriting, not to package installation or system modifications.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0004",
      "category": "data_exfiltration_side_channels",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "medium",
      "classification": "review",
      "status": "suspected",
      "summary": "Potential logging of sensitive data in session tracking and error handling",
      "description": "The skill includes session tracking functionality that logs hook execution data and payloads to system temp directory. While this appears to be for debugging purposes, it could inadvertently capture sensitive information from tool usage or notifications.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "Session logs contain detailed hook execution data and payloads • Logs are stored in: <system-temp-dir>/claude-hooks-sessions/ • await this.saveSessionData(hookType, payload);",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill includes session tracking functionality that logs hook execution data and payloads to system temp directory. While this appears to be for debugging purposes, it could inadvertently capture sensitive information from tool usage or notifications.",
      "recommendation": "Add explicit filtering to exclude sensitive data from session logs, or provide configuration options to disable logging in production environments.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0005",
      "category": "data_exfiltration_side_channels",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "Undeclared external dependency installation via curl command",
      "description": "The skill instructions include a curl command to install Bun runtime from an external URL (https://bun.sh/install). While this appears legitimate for the tool's functionality, it represents an undocumented external network dependency that could be a vector for supply chain attacks.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "Install: curl -fsSL https://bun.sh/install | bash • Install it with: curl -fsSL https://bun.sh/install | bash • curl -fsSL https://bun.sh/install | bash",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill instructions include a curl command to install Bun runtime from an external URL (https://bun.sh/install). While this appears legitimate for the tool's functionality, it represents an undocumented external network dependency that could be a vector for supply chain attacks.",
      "recommendation": "Explicitly declare the Bun installation requirement in the skill metadata's dependencies field, and consider providing alternative installation methods or verification steps for the external script.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0006",
      "category": "capability_squatting",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "Extensive file content with potential instruction volume mismatch",
      "description": "The skill contains a very large amount of code and configuration files (540,201 characters total) that could potentially hide instructions or create confusion about the actual scope of the skill. While this appears to be a legitimate CLI tool for Claude hooks, the sheer volume of content makes it difficult to verify all components align with the declared simple scope.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "[...truncated, 540201 total characters. Files are sorted by security priority — highest-risk content is above.]",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill contains a very large amount of code and configuration files (540,201 characters total) that could potentially hide instructions or create confusion about the actual scope of the skill. While this appears to be a legitimate CLI tool for Claude hooks, the sheer volume of content makes it difficult to verify all components align with the declared simple scope.",
      "recommendation": "Consider splitting this into smaller, more focused skills or providing clearer documentation about what each component does. Ensure all file contents are necessary for the core functionality.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0007",
      "category": "dependency_confusion",
      "capability_tested": "johnlindquist-claude-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Skill installs undeclared dependencies via shell commands",
      "description": "The skill executes 'bun add -d @types/node' and 'bun init -y' commands to install packages that are not listed in the skill's declared dependencies array, which is empty. This bypasses dependency review and could potentially install malicious packages.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "const child = spawn('bun', ['add', '-d', '@types/node'], {\n        cwd: '.claude/hooks',\n        stdio: 'pipe',\n        shell: false,\n      });\n\nconst child = spawn('bun', ['init', '-y'], {\n        cwd: '.claude/hooks',\n        stdio: 'pipe',\n        shell: false,\n      });",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill executes 'bun add -d @types/node' and 'bun init -y' commands to install packages that are not listed in the skill's declared dependencies array, which is empty. This bypasses dependency review and could potentially install malicious packages.",
      "recommendation": "Add '@types/node' and any other packages installed via shell commands to the skill's declared dependencies array in the metadata, or remove the automatic installation and document the manual setup requirements instead.",
      "tested_at": "2026-04-01T03:35:17.542Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    }
  ],
  "summary": {
    "patterns_analyzed": 28,
    "categories_tested": [
      "prompt_injection_chains",
      "privilege_escalation",
      "data_exfiltration_side_channels",
      "capability_squatting",
      "context_poisoning",
      "dependency_confusion"
    ],
    "findings_count": 7,
    "findings_by_severity": {
      "critical": 0,
      "high": 6,
      "medium": 1,
      "low": 0,
      "informational": 0
    },
    "findings_by_classification": {
      "block": 0,
      "warn": 4,
      "review": 3,
      "info": 0
    },
    "findings_deduplicated": 0,
    "duration_ms": 46586,
    "api_usage": {
      "total_input_tokens": 58848,
      "total_output_tokens": 1778,
      "calls": 6
    }
  }
}