{
  "capability_id": "liatrio-hooks",
  "capability_type": "skill",
  "status": "FINDINGS",
  "methodology_version": "1.0",
  "categories_tested": [
    "prompt_injection_chains",
    "privilege_escalation",
    "data_exfiltration_side_channels",
    "capability_squatting",
    "context_poisoning",
    "dependency_confusion"
  ],
  "test_counts": {
    "patterns_analyzed": 14
  },
  "findings": [
    {
      "id": "ADV-2026-0001",
      "category": "capability_squatting",
      "capability_tested": "liatrio-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "Skill contains executable hooks without declared instruction count or visible documentation",
      "description": "The skill defines multiple executable command hooks (SessionStart, SessionEnd, PreToolUse, PostToolUse, etc.) that will run external commands, but there are no visible skill instructions or documentation explaining what these hooks do. The hooks execute 'entire hooks claude-code' commands with various parameters, but the behavior and purpose of these commands is not documented in the skill content.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "\"hooks\": {\n    \"PostToolUse\": [\n      {\n        \"matcher\": \"Task\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"entire hooks claude-code post-task\"\n          }\n        ]\n      }",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill defines multiple executable command hooks (SessionStart, SessionEnd, PreToolUse, PostToolUse, etc.) that will run external commands, but there are no visible skill instructions or documentation explaining what these hooks do. The hooks execute 'entire hooks claude-code' commands with various parameters, but the behavior and purpose of these commands is not documented in the skill content.",
      "recommendation": "Add clear documentation explaining what each hook command does, when it executes, and what data it processes. Include visible instructions that describe the skill's behavior to users.",
      "tested_at": "2026-04-01T04:04:59.772Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0002",
      "category": "dependency_confusion",
      "capability_tested": "liatrio-hooks",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Skill executes undeclared external commands through hook system",
      "description": "The skill defines multiple hooks that execute 'entire hooks claude-code' commands with various parameters (post-task, pre-task, session-start, etc.). These commands are not declared in the skill's dependencies list, which is empty. The 'entire' command appears to be an external binary or script that gets executed at various lifecycle events, creating an undeclared dependency that bypasses user review.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "\"command\": \"entire hooks claude-code post-task\", \"command\": \"entire hooks claude-code pre-task\", \"command\": \"entire hooks claude-code session-start\", \"command\": \"entire hooks claude-code session-end\", \"command\": \"entire hooks claude-code stop\", \"command\": \"entire hooks claude-code user-prompt-submit\"",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill defines multiple hooks that execute 'entire hooks claude-code' commands with various parameters (post-task, pre-task, session-start, etc.). These commands are not declared in the skill's dependencies list, which is empty. The 'entire' command appears to be an external binary or script that gets executed at various lifecycle events, creating an undeclared dependency that bypasses user review.",
      "recommendation": "Declare the 'entire' command/package as an explicit dependency in the skill's declared dependencies list, or remove the undeclared command executions from the hooks.",
      "tested_at": "2026-04-01T04:04:59.772Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    }
  ],
  "summary": {
    "patterns_analyzed": 14,
    "categories_tested": [
      "prompt_injection_chains",
      "privilege_escalation",
      "data_exfiltration_side_channels",
      "capability_squatting",
      "context_poisoning",
      "dependency_confusion"
    ],
    "findings_count": 2,
    "findings_by_severity": {
      "critical": 0,
      "high": 2,
      "medium": 0,
      "low": 0,
      "informational": 0
    },
    "findings_by_classification": {
      "block": 0,
      "warn": 1,
      "review": 1,
      "info": 0
    },
    "findings_deduplicated": 0,
    "duration_ms": 17884,
    "api_usage": {
      "total_input_tokens": 9853,
      "total_output_tokens": 603,
      "calls": 6
    }
  }
}