SEC381 / CLAUDE-HOOK-TIMEOUT

SEC381 flags shared Claude settings when a type: "command" hook omits an explicit timeout.

Why It Matters

Shared command hooks are part of the team-wide agent execution path. Without an explicit timeout, a hook can hang unpredictably, slow down every run, or make failures harder to review and reproduce across machines.

Positioning

This is a compat rule, not a headline security finding. The issue is bounded execution and shared-config hygiene, so it now lives in the compatibility lane.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected Claude settings surface
• the path is not fixture-like
• a hook entry has type: "command"
• the same hook entry has command
• the same hook entry does not declare timeout

Clean Cases

These stay clean:

• command hooks with an explicit timeout
• non-command hooks
• fixture-like examples under test or fixture paths

Example Trigger

{
  "hooks": {
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo done"
          }
        ]
      }
    ]
  }
}

Safer Example

{
  "hooks": {
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo done",
            "timeout": 5
          }
        ]
      }
    ]
  }
}

How To Fix

Add an explicit timeout to each shared command hook. Keep the timeout short and reviewable so the hook stays bounded across local machines and CI-like automation.