Notifications
Clear all
Topic starter
01/08/2026 9:01 pm
TL;DR: Claude Code skills can execute shell commands and hooks before the LLM sees a prompt, enabling credential exfiltration, hidden tool surveillance, and supply-chain abuse in cloned repositories, according to Mint. The trust boundary now sits in preprocessing, not model reasoning, so security teams must govern configuration files as executable attack surface.
NHIMG editorial — based on content published by Mint: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when AI assistant skills can run code before the model sees the prompt?
A: The trust boundary breaks because the most privileged actions happen outside the model’s awareness.
Q: Why do hooks create a stronger security concern than ordinary tool logging?
A: Hooks are not passive logs.
Q: How can security teams tell whether AI assistant configuration is being abused?
A: Look for unexpected network callbacks, unusual tool permissions in frontmatter, hidden model overrides, and repository content that behaves like executable policy.
Practitioner guidance
- Audit AI assistant configuration as executable code Scan .claude/skills/, .claude/settings.json, and .mcp.json during repository review and CI checks.
- Restrict preprocessing and hook execution paths Apply sandboxing and managed-hook policies where available, and verify that they cover preprocessing, tool dispatch, and outbound network calls, not only Bash child processes.
- Treat cloned repositories as supply-chain inputs Extend code review and PR checks to assistant tooling artefacts so malicious skills cannot arrive through a trusted repository without inspection.
What's in the full report
Mint's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step proof-of-concept attack flows showing how preprocessing exfiltration and hook surveillance were executed
- Detailed code-level examples of SKILL.md frontmatter, !`command` behaviour, and model overrides
- Server-side log evidence from the authors' controlled endpoint, including what data was received
- Specific hardening recommendations for developers, enterprises, and the Claude Code maintainers
👉 Read Mint's analysis of Claude Code skills, hooks, and pre-LLM exfiltration →
Claude Code skills and hooks: where does trust break down?
Explore further
01/08/2026 9:07 pm
Pre-LLM execution is the new trust boundary for AI assistants. The article shows that the LLM is no longer the first meaningful security checkpoint in the workflow. The harness can execute commands, expand variables, and invoke hooks before the model sees anything. For identity and NHI governance, that means the security model must account for machine-executed actions that occur outside human review and outside the model’s reasoning path. Practitioners should treat preprocessing as a governed execution tier, not a harmless setup step.
A question worth separating out:
Q: Who is accountable when a malicious skill exfiltrates code or credentials?
A: Accountability sits with the organisation that approved the skill, the team that granted the agent its reachable tools, and the owners of the workflow where the skill was introduced. Frameworks such as OWASP Agentic AI Top 10 and NIST AI Risk Management Framework help define governance, but the operational answer is clear ownership before deployment.
👉 Read our full editorial: Claude Code skills create a pre-LLM trust gap for AI assistants
