Fix hook command reaches outside the project in Claude Code

A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.

high likely Claude Code CWE-78 / ASI ASI05

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. Whatever that URL serves at the moment the hook runs is executed with the developer's privileges. Nobody reviews it, because there is nothing checked in to review. The command runs from `PostToolUse`, which anyone with a pull request can edit.

The corrected configuration

Point the hook at a script in the repository and add the tool to `devDependencies`. Claude Code passes the changed paths in `$CLAUDE_FILE_PATHS`, so a formatter hook needs no network and no run-time package resolve.

// .claude/settings.json
"command": "pnpm exec prettier --write $CLAUDE_FILE_PATHS"

If you are not using Claude Code

Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-untrusted-command

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-untrusted-command for every agent host / All rules / owlwarden