AE-CC-001 is a Blocker. While it is active, the final Charter score is held at ≤59. It is never auto-fixed — dangerous hook commands require human review, so Charter shows the evidence and guidance but will not rewrite hook configurations automatically.
Why this rule
Agent hook configurations run shell commands automatically on events like file save or tool use. A destructive or injection-vulnerable hook fires without explicit user action — in an agent session, the agent may trigger it indirectly through file writes. Because hooks execute outside the agent’s visible reasoning loop, a compromised hook can cause irrecoverable damage — deleted files, elevated permissions, or remote code execution — before any human has a chance to intervene.What triggers it
Charter scans agent hook configuration files —.claude/settings.json and .claude/settings.local.json for Claude Code, and .cursor/hooks.json for Cursor — and inspects every command declared across all hook events.
It flags commands that fall into three danger classes:
Charter quotes the offending command in the finding evidence so you can locate it immediately.
Examples
- Failing
- Passing
A hook command using A hook elevating permissions is also flagged:
rm -rf with a shell-expanded path — destructive and flagged Blocker:.claude/settings.json
.claude/settings.json
How to fix
1
Locate the flagged hook
Run
charter explain with AE-CC-001 to see the finding evidence. Charter identifies the config file and the offending command pattern.2
Replace the dangerous pattern
Substitute destructive or injection-vulnerable commands with explicit, scoped, non-destructive alternatives. Prefer array-form execution (
args) over shell strings to avoid expansion.3
Review against the injection model
For each hook, ask: “If an agent were prompt-injected, could this hook be weaponized?” If yes, redesign the command to be safe regardless of what the agent does.
4
Commit the change
Commit the updated hook config. Charter re-evaluates on the next scan.
Score impact
Blocker (−20 per finding). This finding engages the Blocker cap — the final score is held at ≤59 while it is active. Caps are reserved for raw-secret and Blocker findings.Edge cases
Hook managers out of scope for v1
Hook managers out of scope for v1
Only the three JSON hook files are scanned in v1.
hk.pkl, .pre-commit-config.yaml, lefthook.yml, and .husky/ shell-dir hooks are out of scope and not evaluated.Controlled && chains
Controlled && chains
A controlled
&& chain where both sides are safe (e.g. cd app && npm test) is not flagged — operator chaining is only flagged when the left-hand side accepts open or agent-controlled input.Malformed JSON hook files
Malformed JSON hook files
A hook file that cannot be parsed fails the scan fast with a wrapped error. Charter surfaces the parse failure rather than silently passing the file.
Related rules
AE-CC-002
Requires explicit edit-scope boundaries in the agent context file.
AE-SEC-001
Detects hardcoded secrets in tracked files.