Why It Matters

Committed Claude settings hooks run as shared checked-in automation. If a hook command launches through npx, uvx, pnpm dlx, yarn dlx, or pipx run, the repo does not fully describe what code the hook will run. The package can resolve differently on another machine, after a registry update, or when @latest moves.

What Triggers

SEC340 applies to committed Claude settings JSON and triggers when a hook entry with type: "command" uses a dynamic package launcher in its command string.

Examples that trigger:

{
  "hooks": {
    "PreToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "npx claude-flow@alpha hooks pre-command"
          }
        ]
      }
    ]
  }
}

Examples that stay clean:

{
  "hooks": {
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "./hooks/stop.sh"
          }
        ]
      }
    ]
  }
}

statusLine command entries stay out of scope for this rule.

False Positives

False positives should be low because the detector is structural and limited to committed Claude hook commands. The practical tradeoff is whether a team intentionally accepts runtime package resolution in shared automation, not whether the hook is malicious.

Remediation

Replace the dynamic package launch with a vendored script, pinned local binary, or another reviewed reproducible hook command.