hook-development
What this skill does
The skill provides guidance on implementing hooks for Claude Code plugins, with a focus on security validation, test enforcement, and context loading. It is a development tool for creating event-drive
github/galaxy-dawn - Privilege Escalation - 5.1k stars
Threat analysis
Skill info
pkg:github/Galaxy-Dawn/claude-scholar@2f7766f?skill=hook-developmentAssessments (2)
Privilege Escalation
Privilege Escalation via local-llm-review
examples/load-context.sh
The script writes to $CLAUDE_ENV_FILE, which could be a sensitive file if not properly controlled. If $CLAUDE_ENV_FILE is not properly validated, this could allow arbitrary environment variable modifiInsecure Defaults
Insecure Defaults via local-llm-review
examples/load-context.sh
The script does not validate the $CLAUDE_PROJECT_DIR or $CLAUDE_ENV_FILE variables before using them, which could lead to unintended file operations if these variables are manipulated.Badge
Add the Anomity scan badge for hook-development to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of hook-development? Report an issue or request a rescan.
