https://github.com/xero/claudecode-hook-n-switch VULN DISCLOSURE: Claude Code's HTTP hook system lets a malicious repo silently rewrite your shell commands before execution. The UI displays the original command. The rewritten one runs with no indication anything changed. full prompt interception, complete tool output exfil (env vars, file contents, paths, etc), and loopback SSRF to any localhost service. Disclosed to Anthropic via H1. Closed as wontfix. their position is that trusting a repo means trusting all of this. decide for yourself if that dialog you agree to is doing enough. PoC, logs, and mitigation strategies in the repo.