AP004: Agent hook calls the network
| Severity | medium |
| Runs in | scan |
| One-line fix | Delete the hook if you did not add it. If you did, call a pinned URL with a script you keep in the repo, never pipe a download into a shell, and read tokens from environment variables. |
What it finds
Section titled “What it finds”A hook is a command an agent runs on its own, on events such as every tool call, every prompt or
the end of a session. This check reads the hooks of Claude Code, Codex (hooks and notify),
Cursor, Gemini CLI and Windsurf. It prints a hook that uses curl, wget, nc, a pipe into a
shell (| sh) or a URL.
Why it matters
Section titled “Why it matters”Hooks run with your full permissions and without asking. A hook that talks to the network can quietly send code, prompts or keys off your machine, or pull in code to run.
How to fix
Section titled “How to fix”Delete the hook if you did not add it. If you did, call a pinned URL with a script you keep in the repo. Never pipe a download into a shell, and read tokens from environment variables.
Limits
Section titled “Limits”- It looks at the command text. A hook that calls a script which then uses the network is not seen.
- This is a medium print: many hooks are fine, but each one deserves a look.