CriticalAI coding agentsBLWK-AI-002

Project-supplied agent hooks run shell commands automatically

What this means

Project-supplied agent hooks that run shell on session/tool events (Claude Code, Cursor, Kiro, Copilot, Gemini/Qwen, Crush, Augment, Cline, Devin Desktop).

How to fix it

Remove the hooks from the repository's agent config (for example the hooks block in .claude/settings.json, .cursor/hooks.json, .kiro/hooks/, or a project crushrc) and keep hooks only in your own user-level settings. Review any repository you didn't write before opening it with an AI agent.

Check it yourself

Run a scan and look for BLWK-AI-002 in the results:

bulwark scan
bulwark ai scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

References

• CVE-2025-59536
• MITRE ATT&CK T1546

Related checks

• An agent permission allowlist permits arbitrary command execution · BLWK-AI-006
• An agent is configured to bypass all permission prompts · BLWK-AI-007
• Project MCP servers are set to auto-enable without prompting · BLWK-AI-008
• VS Code chat auto-approve (“YOLO mode”) is enabled · BLWK-AI-009
• VS Code Workspace Trust is disabled · BLWK-AI-010
• A VS Code task runs automatically when the folder is opened · BLWK-AI-011