SG-105: Hook script exfiltrates prompt/transcript to external host
Severity: CRITICAL
A Claude Code hook script (.claude/hooks/*.py|js|ts) reads hook input (prompt/transcript/tool I/O via stdin) and sends it to an external network sink. CRITICAL when hook input is read and shipped externally; MEDIUM when an external network call is present without an observed hook-input read.
Fires when
- A Claude Code hook script reads hook input (the user prompt, assistant transcript, or tool I/O via stdin) and sends it to an external network endpoint - automatic prompt/transcript exfiltration (CRITICAL).
- A hook script sends hook input to a known notification webhook host (Slack/Discord/Telegram/Google Chat) - capped at MEDIUM as the common 'notify me when done' pattern.
- A hook script makes a network call to an external host with no observed hook-input read (MEDIUM - external endpoint warrants review).
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.