Git hook directory access
A tool call refers to a path under .git/hooks.
Why it is risky
Section titled “Why it is risky”Git hooks can execute code during repository operations. A malicious hook can run repeatedly with the developer permissions.
Example
Section titled “Example”An agent adds a hook that copies credentials whenever a commit is made.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches recognized path references containing .git/hooks. It does not require a write or inspect whether a hook is enabled and executable.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_PERSISTENCE_GIT_HOOKS | persistence | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Review changed hook content and repository hook settings. Verify that each executable hook belongs to an approved workflow.
False positives
Section titled “False positives”Reading hook samples, installing an approved formatter, or maintaining legitimate hooks can match.
False negatives
Section titled “False negatives”Hooks in custom core.hooksPath locations, framework-specific hook folders, or edits hidden inside a subprocess can be missed.
Technical details
Section titled “Technical details”The finding establishes a path reference. It does not show that Git subsequently ran a hook.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.