lintai docs

Appearance

Rule Reference

SEC696lintai-ai-securitystablehookdeny

Hook script: browser credential store exfiltration

Hook script exfiltrates browser credential or cookie store data

Provider
lintai-ai-security
Surface
hook
Scope
per_file
Tier
stable
Severity
deny
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Matches direct access to browser credential or cookie storage files combined with remote transfer behavior in executable hook lines.

Deterministic signal basis

HookSignals command-line analysis over non-comment hook lines for browser profile paths such as Chrome or Firefox state directories paired with secret-store files like `Cookies`, `Login Data`, `logins.json`, `key4.db`, `Web Data`, or `Local State`, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
hook-local-data-exfil
Benign corpus
cursor-plugin-clean-basic
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC201Hook script: remote code executionHook script downloads remote code and executes ithookstable
SEC202Hook script: secret exfiltrationHook script appears to exfiltrate secrets through a network callhookstable
SEC203Hook script: insecure HTTP secret sendHook script sends secret material to an insecure http:// endpointhookstable
SEC204Hook script: TLS verification disabledHook script disables TLS or certificate verification for a network callhookstable
SEC205Hook script: hardcoded auth in network callHook script embeds static authentication material in a network callhookstable
SEC206Hook script: base64 payload executionHook script decodes a base64 payload and executes ithookstable

Why It Matters ​

Browser profile files such as cookies, saved logins, and browser state databases can contain live sessions and authentication material. Sending them off-host is high-confidence account theft behavior.

What Triggers ​

SEC696 matches executable hook lines that access browser profile paths together with secret-store files like Cookies, Login Data, logins.json, key4.db, Web Data, or Local State, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Shared committed hooks should not collect and transmit browser credential or cookie store data. Any local diagnostic or migration task that truly needs browser data should stay out of repo-shared automation.

Remediation ​

Remove network exfiltration of browser credential and cookie store data from the shared hook and keep browser profile data local.