> ## Documentation Index
> Fetch the complete documentation index at: https://tashfiq.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AE-CC-001

> Agent hook configurations must not contain dangerous shell commands that a prompt-injected agent could weaponize (OWASP MCP Top 10 beta, MCP05 Command Injection & Execution).

**Rule ID:** AE-CC-001 · **Severity:** <Badge color="red">Blocker</Badge> · **Category:** Agent Config · **Auto-fixable:** No

<Note>
  AE-CC-001 is a Blocker. While it is active, the final Charter score is held at **≤59**. It is never auto-fixed — dangerous hook commands require human review, so Charter shows the evidence and guidance but will not rewrite hook configurations automatically.
</Note>

## Why this rule

Agent hook configurations run shell commands automatically on events like file save or tool use. A destructive or injection-vulnerable hook fires without explicit user action — in an agent session, the agent may trigger it indirectly through file writes.

Because hooks execute outside the agent's visible reasoning loop, a compromised hook can cause irrecoverable damage — deleted files, elevated permissions, or remote code execution — before any human has a chance to intervene.

## What triggers it

Charter scans agent hook configuration files — `.claude/settings.json` and `.claude/settings.local.json` for Claude Code, and `.cursor/hooks.json` for Cursor — and inspects every command declared across all hook events.

It flags commands that fall into three danger classes:

| Danger class         | Examples                                      | Why dangerous                                         |
| -------------------- | --------------------------------------------- | ----------------------------------------------------- |
| Shell injection      | `$()`, backticks, `&&` with open input        | Agent-controlled input can execute arbitrary commands |
| Destructive commands | `rm -rf`, `git reset --hard`, `git clean -fd` | Irrecoverable file loss triggered automatically       |
| Privilege escalation | `sudo`, `chmod 777`, `chown -R`               | Elevates permissions beyond intended scope            |

Charter quotes the offending command in the finding evidence so you can locate it immediately.

## Examples

<Tabs>
  <Tab title="Failing">
    A hook command using `rm -rf` with a shell-expanded path — destructive and flagged Blocker:

    ```json .claude/settings.json theme={null}
    {
      "hooks": {
        "PostToolUse": [{
          "command": "rm -rf /tmp/$(basename $FILE)"
        }]
      }
    }
    ```

    A hook elevating permissions is also flagged:

    ```json .claude/settings.json theme={null}
    {
      "hooks": {
        "PostToolUse": [{
          "command": "sudo chmod 777 ./bin"
        }]
      }
    }
    ```
  </Tab>

  <Tab title="Passing">
    A hook delegating to an explicit, bounded script — no destructive patterns:

    ```json .claude/settings.json theme={null}
    {
      "hooks": {
        "PostToolUse": [{
          "command": "npx prettier --write \"$FILE_PATH\""
        }]
      }
    }
    ```

    Or delegating to a scoped hook script in the repo:

    ```json .claude/settings.json theme={null}
    {
      "hooks": {
        "PreToolUse": [{
          "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/format.sh"
        }]
      }
    }
    ```
  </Tab>
</Tabs>

## How to fix

<Steps>
  <Step title="Locate the flagged hook">
    Run [`charter explain`](/cli/explain) with `AE-CC-001` to see the finding evidence. Charter identifies the config file and the offending command pattern.
  </Step>

  <Step title="Replace the dangerous pattern">
    Substitute destructive or injection-vulnerable commands with explicit, scoped, non-destructive alternatives. Prefer array-form execution (`args`) over shell strings to avoid expansion.
  </Step>

  <Step title="Review against the injection model">
    For each hook, ask: "If an agent were prompt-injected, could this hook be weaponized?" If yes, redesign the command to be safe regardless of what the agent does.
  </Step>

  <Step title="Commit the change">
    Commit the updated hook config. Charter re-evaluates on the next scan.
  </Step>
</Steps>

<Tip>
  OWASP MCP Top 10 item MCP05 covers command injection in agent hooks. Charter's AE-CC-001 is a static check for the most obvious patterns — it catches the dangerous cases without requiring runtime analysis.
</Tip>

## Score impact

<Note>
  `Blocker` (−20 per finding). This finding engages the Blocker cap — the final [score](/docs/concepts/scoring-and-caps) is held at **≤59** while it is active. Caps are reserved for raw-secret and Blocker findings.
</Note>

## Edge cases

<AccordionGroup>
  <Accordion title="Hook managers out of scope for v1">
    Only the three JSON hook files are scanned in v1. `hk.pkl`, `.pre-commit-config.yaml`, `lefthook.yml`, and `.husky/` shell-dir hooks are out of scope and not evaluated.
  </Accordion>

  <Accordion title="Controlled && chains">
    A controlled `&&` chain where both sides are safe (e.g. `cd app && npm test`) is not flagged — operator chaining is only flagged when the left-hand side accepts open or agent-controlled input.
  </Accordion>

  <Accordion title="Malformed JSON hook files">
    A hook file that cannot be parsed fails the scan fast with a wrapped error. Charter surfaces the parse failure rather than silently passing the file.
  </Accordion>
</AccordionGroup>

## Related rules

<CardGroup cols={2}>
  <Card title="AE-CC-002" icon="shield-half" href="/rules/AE-CC-002">
    Requires explicit edit-scope boundaries in the agent context file.
  </Card>

  <Card title="AE-SEC-001" icon="key" href="/rules/AE-SEC-001">
    Detects hardcoded secrets in tracked files.
  </Card>
</CardGroup>

## CLI

```bash theme={null}
charter explain AE-CC-001
```