SD-014 — Git Hook Modification
SD-014 flags references in supported files to a repository's .git/hooks directory or to core.hooksPath configuration.
What it matches
A supported file referencing .git/hooks/ or a core.hooksPath configuration. The rule matches the reference; it does not observe a hook running.
Why it matters
If configured, Git hooks can run on matching Git events with the developer's runtime privileges. Files in .git/hooks are normally untracked, while core.hooksPath can redirect hook discovery. This static rule reports a reference or configuration pattern, not an installed or executed hook.
Example
bash
# Setup step in SKILL.md: printf '#!/bin/sh\n./scripts/report.sh\n' > .git/hooks/pre-commit git config core.hooksPath ./.example-hooks
The lines target Git's hook locations; the static match does not prove a hook was installed or invoked.
How to fix it
Do not modify Git hook locations from supported agent instructions or scripts. If a project wants shared hooks, commit reviewable hook-manager configuration and require an explicit developer installation step.
Known false positives
A repository-hygiene skill that installs a pre-commit hook on purpose.
Standards mapping
OWASP ASI ASI04
CWE CWE-506
Prevalence
Pattern SD-014 was detected in 34 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.