SG-091: Hook auto-executes local script
Severity: MEDIUM
Hook's command field points to a local script file (.sh / .bash / .py / .js etc) that auto-runs on a Claude Code lifecycle event. Severity is HIGH for SessionStart / SessionEnd (run every agent session).
Fires when
- A hook's command invokes a local script file (a path ending in .sh / .bash / .zsh / .fish / .py / .js / .ts / .rb / .pl / .ps1) that auto-runs on the lifecycle event.
- Severity escalates from MEDIUM to HIGH when the triggering event is SessionStart or SessionEnd, so the script runs on every agent session (persistence-style).
Related CVEs
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.