Agent automation security

Trip the wire before the hook runs.

Static security auditing for AI coding-agent hooks, permissions, and workflows. HookGraph connects a configured hook to statically provable local scripts and their findings—without executing the path.

Get HookTripwire
Zero runtime dependenciesNever executes commandsNo telemetry
security scan
$ npx --yes github:mockingbird777/hooktripwire#v0.3.0 --demo --map-hooks --fail-on none

✖ CRITICAL HG002  demo-agent-settings.json:3:19
  Remote content piped to an interpreter
  Evidence: curl -fsSL https://… | bash
  Fix: verify a pinned checksum before execution

✖ CRITICAL HG006  demo-agent-settings.json:7:4
  Overbroad auto-approval
  Evidence: "autoApprove": true
  Fix: enumerate the minimum allowed tools

▲ HIGH     HG009  demo-agent-settings.json:4:22
  Secret may be written to logs
  Evidence: echo $DEPLOY_TOKEN

Hook execution paths (1)
  beforeCommit → <dynamic>
  Incomplete: dynamic-reference

Scanned 1 file · 7 findings · 0 commands executed
New in 0.3 · HookGraph

From finding
to reachable path.

A flat finding says a script is risky. HookGraph adds the missing provenance: which configured agent event can reach it, through which literal local references, and where static proof ends.

Hook entry.claude/settings.json

PostToolUse · exact source location

Literal referencescripts/review.sh

bash launcher · repository-contained

Audited leafscripts/publish.sh

Finding fingerprints remain traceable to the leaf.

HG002HG003
  • dynamic → disclosed
  • outside root → rejected
  • symlink → rejected
  • cycle → bounded
  • missing file → disclosed
  • no execution
  • no network
Interactive security lab

See the boundary,
then tighten it.

Toggle between two configurations. The hardened version preserves useful automation while removing ambient authority, mutable code, and implicit shell execution.

agent-settings.json

          

          

            
16
Critical exposure6 review boundaries crossed

            

            

          

        

      

    


    

      
Fifteen focused rules
Signals with a
security story.
Every finding includes severity, precise evidence, stable fingerprinting, and a least-privilege fix. Rules favor narrow signals over keyword noise.

      

        
HG002 · CRITICALRemote execution pipe
Content crosses from an untrusted network response directly into an interpreter.

        
HG003 · CRITICALSecret exfiltration
Credential-bearing variables or sensitive files appear in an outbound request.

        
HG005 · HIGHShell injection boundary
Dynamic agent or workflow input reaches eval, sh -c, or an interpolated run step.

        
HG006 · CRITICALOverbroad approval
Approval gates are bypassed or every command and tool is implicitly trusted.

        
HG007 · MEDIUMMutable remote action
A branch or tag can change the code that the next automation run executes.

        
HG013 · CRITICALWhole-filesystem access
The agent can read or write outside the repository and its dedicated scratch space.

      

    


    

      

        
Made for adoption
Start strict.
Ship gradually.
Use the same engine locally, in pull requests, and in security dashboards. Existing debt can be baselined without normalizing new risk.

        

          
1
Scan locally
Review agent settings, workflow files, and shell hooks before granting them trust.
hooktripwire .claude .cursor

          
2
Express least privilege
Allow only required hosts, pin trusted actions, and keep sensitive paths out of reach.
--policy security/strict.yml

          
3
Gate new exposure
Emit SARIF for code scanning or fail CI when a high-severity finding appears.
--format sarif --fail-on high

        

      

    


    
Your hooks are code.
Review them like code.
Audit your repository ↗