Why It Matters

Committed Claude settings hooks run as shared checked-in automation. If a hook command shells out through npx, uvx, pnpm dlx, yarn dlx, or pipx run, the hook depends on mutable package resolution instead of a reproducible reviewed command path.

What Triggers

SEC340 applies to committed Claude settings JSON and triggers when a hook entry with type: "command" uses a mutable package launcher in its command string.

Examples that trigger:

{
  "hooks": {
    "PreToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "npx claude-flow@alpha hooks pre-command"
          }
        ]
      }
    ]
  }
}

Examples that stay clean:

{
  "hooks": {
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "./hooks/stop.sh"
          }
        ]
      }
    ]
  }
}

statusLine command entries stay out of scope for this rule.

False Positives

False positives should be low because the detector is structural and limited to committed Claude hook commands. The practical tradeoff is whether a team intentionally accepts mutable launcher convenience in shared automation, not whether the hook is “malicious”.

Remediation

Replace the mutable package launcher with a vendored script, pinned local binary, or another reviewed reproducible hook command.