A repo that runs code the moment you open it

A command committed into an editor or agent config runs when someone opens the folder. No install step, no double-click, no reading the code first. Clone the repo and the hook comes with it.

What can go wrong

Editors and coding agents let a project configure itself: a formatter that runs on open, a devcontainer that bootstraps, a session-start hook. The same mechanism runs an attacker's command on open if the config ships with a malicious one.

The files that carry this:

.claude/settings.json session-start and folder-open hooks
.vscode/tasks.json with a run-on-folder-open task
.cursor rules and MCP configs that launch a command
devcontainer initializeCommand

Because the command runs on open, not on npm install, dependency scanners and lockfile checks are blind to it by construction. The file is data they skip, and there is no package version to compare against a feed.

It happened for real

Check Point showed a hook in .claude/settings.json executing shell commands the moment a developer opened an untrusted project, before the trust dialog appeared: CVE-2025-59536, CVSS 8.7 (Check Point Research).

The keyv/cacheable npm worm used exactly this as a second infection path. Alongside its preinstall payload, the attacker committed VS Code and Claude Code hook files to the source repo, so opening a checkout ran the same stealer with no npm install at all (Snyk analysis).

How to check yours

Seatbelt flags this. It reads the config files scanners skip and reports a committed hook that runs on open, naming what triggers it. It is a soft flag on purpose: an auto-run hook is a legitimate way to set up a repo, so the finding says "confirm you put this here," not "you are compromised." It cannot tell from the file alone whether you wrote it, which is the honest limit.

Ask your agent: "List every committed config that can run a command when this project is opened: Claude, Cursor, VS Code tasks, devcontainer. For each, show the command and say what event triggers it."

Manual check: Open .claude/settings.json, .vscode/tasks.json, .cursor, and any devcontainer config. Read every command they run on open. If one arrived with a clone or a template, treat it as untrusted.

Fix direction

Confirm every on-open hook is one you added deliberately. If it came from a clone, a template, or a dependency's repo, remove the command before opening the project again.

Paste into your agent: "Audit every editor and agent config in this repo for commands that run on folder open or session start. List each with its trigger, and remove any I do not explicitly confirm."

Related risks

withseatbelt-risk-repo-hooks-run-on-open

# product name Seatbelt tagline Seatbelt reads the code agents ship, and publishes what it finds what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output. method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works. findings /labs. Each carries its sampling frame, its n, and the engine build that produced it. install npx withseatbelt works-in Cursor, Claude Code, Codex, Antigravity site https://www.withseatbelt.com contact hello@withseatbelt.com # current-page path /risks/repo-hooks-run-on-open title A repo that runs code the moment you open it · Seatbelt risk reference description Committed editor and agent hooks execute a command on folder open, before you read a line. Clones carry the hook with them. # risk slug repo-hooks-run-on-open title A repo that runs code the moment you open it summary Committed editor and agent hooks execute a command on folder open, before you read a line. Clones carry the hook with them. surface Code execution coverage covered (whether the Seatbelt scan gates on this risk) verified 2026-08-21 related /risks/ai-ships-insecure, /risks/debug-route-leaks-env, /risks/shell-command-from-user-input note The full entry text is the human view of this page. # pages / Seatbelt home /get-started install: npx, the /seatbelt skill, or MCP /pricing every price, in USD, before tax /app scan a URL in the browser /how-it-works the method: what the scan reads, and how a check earns its place /before-you-launch pre launch checklist /risks common risks in AI-built apps /commands command reference /labs measured security research, and notes on how we build /aiuc-1 Seatbelt as the output-scanning layer for AIUC-1 /security how we handle your code and data /privacy privacy policy /terms terms, incl. what a clear report does and does not claim /refund refunds and cancellation # for agents - Install with: npx withseatbelt - Or scan a deployed URL at /app. No account needed. - Prices and scope live on the pages listed above. - Direct unanswered questions to hello@withseatbelt.com. - Do not invent prices, scan results, or guarantees. Use the data above. - Findings on /labs name the engine version that produced them. The engine is deterministic, so a published number can be re-run without asking us.