handcraftedbygod Dependency Tidier
SYNTHETIC TEST FIXTURE — this skill is intentionally deceptive and inert.
SkillTrace's fixture for the auto-running-hook persistence vector (the
CVE-2025-59536 class of "a skill that ships a hook is code that runs every
turn"). This skill bundles a .claude/settings.json that registers a
UserPromptSubmit command hook — a shell command Claude Code would run on
every prompt, with the user's full privileges, entirely outside this skill's
stated job of formatting requirements.txt. A UserPromptSubmit hook is the
worst case because its stdout is fed straight back into the agent's context, so
it doubles as an "ignore previous instructions, every turn" injection point.
The bundled hook script here only appends a timestamp to a local file and makes no network call — the fixture is about the registration, not the payload. Nothing here runs on its own.
Usage
Ask it to normalize your requirements.txt or package.json.