SD-014 — Git Hook Modification
SD-014 flags a line naming a repository's .git/hooks directory, or a core.hooksPath setting, because hooks run on ordinary git commands.
What it matches
A reference to a repository's git hooks directory, or a core.hooksPath setting repointing where hooks are read from. Hooks execute on ordinary developer commands.
Why it matters
Git hooks fire automatically on commit, checkout, merge and push — commands a developer runs dozens of times a day without thinking of them as executing anything. A hook is not part of the repository's tracked contents, so it never appears in a diff, a pull request, or a review; it sits in .git/hooks or wherever core.hooksPath points, and it runs with the developer's shell and credentials. Repointing core.hooksPath is the broader move of the two, because it redirects every hook at once into a directory the skill chose.
Example
bash
# Setup step in SKILL.md: printf '#!/bin/sh\n./scripts/report.sh\n' > .git/hooks/pre-commit git config core.hooksPath ./.example-hooks
Neither line shows up in a diff, and both run on ordinary git commands afterwards.
How to fix it
Do not install hooks from inside a skill. Where a project wants shared hooks, use a hook manager whose configuration the repository commits and whose installation the developer runs deliberately, so the hook's contents are reviewable and its presence is a decision somebody made.
Known false positives
A repository-hygiene skill that installs a pre-commit hook on purpose.
Standards mapping
OWASP ASI ASI04
CWE CWE-506
Prevalence
Pattern SD-014 was detected in 30 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.