A few facts about the hook.
How is the hook delivered? metadata — doesn't set the scoreiRecorded for reporting and guidance only. It does not set the "who can be affected" score — a plugin might reach one developer or an entire enterprise. Actual reach is question 3.
1What kind of hook is it?iWhat the hook runs — a command/script, web request, MCP tool, model prompt, or sub-agent. The type shapes the risk: HTTP sends data out, sub-agents can use tools.
2When does it run?iThe event that triggers it. Automatic ones like SessionStart run the moment a project opens — a common attack entry point — others only during your work.
—
These decide the risk level for hooks with no red flags.
3Who can be affected by this hook?iScore by actual deployment reach — how many users, projects, repositories, or environments it touches — not by whether it lives in settings, a plugin, a skill, an agent, or SDK code. If you can't tell, pick the higher-risk option.
4What assurance exists for the exact hook artifact?iAssess the exact code and dependencies that will run — not the team, vendor, marketplace, or repository name. Internal and well-known sources are not automatically safer if the artifact is unreviewed or can change after approval. A repo-committed script counts as "pinned" only if it lands via reviewed PRs on a protected branch and any change re-runs this assessment; otherwise it's mutable.
5How much does it fire?iHow broadly it fires. What the matcher filters depends on the event: a tool name for tool events, or the session source (startup / resume / clear / compact) for SessionStart. No matcher means it fires on every occurrence — and a narrow match never makes a dangerous action safe.
6What can it do? check all that applyiIts real effects: reads, writes, network, secrets, tool decisions. This is the heart of the risk — secrets plus network, or writing outside the project, are high-impact.
Does the matcher cover Bash, Edit, Write, or any tool that can run commands or change files?iShown because this hook auto-approves actions or rewrites what a tool does (question 6). If the matcher covers command- or file-changing tools — or you're not sure — the auto-approval expands authority broadly and needs security review.
Is the secret used solely to authenticate to the fixed destination recorded in this assessment?iShown because this hook reads secrets AND reaches a service, model, tool, or agent (question 6). “Yes” means the credential only logs in to the one recorded destination — not a general exfiltration path. “No” or “not sure” fail closed to the data-egress red flag.
7Can you read and trust the code?iWhether you can read and trust the code. Short isn’t safe — a one-liner can fetch and run remote code — while a clear, pinned, tested script is trustworthy.
8Does the hook insert values from the hook event (paths, tool input, prompt text) into a shell command, eval, or SQL/HTTP request?iHooks receive attacker-influenceable JSON — file paths, tool inputs, prompt text. Putting those raw values into a shell string or eval is a command-injection path; passing them as arguments (argv) or validating/escaping them is safe.
Are any of these true?