Hi, there.
I believe this project can be a gaming change for the Agentic software development. Can I have your thoughts in regards the potential security risks below?
Security Risks
CRITICAL — Plugin Hook Shell Execution + Your Secrets
src/hook.rs executes plugin-defined commands as:
Command::new("sh").arg("-c").arg(&hook.command)
Hook commands come from SYMPOSIUM.toml files in plugin directories. The default, auto-enabled, auto-updating plugin source is symposium-dev/recommendations on GitHub (config.rs). A compromised or malicious plugin repo can run arbitrary shell commands on every Claude Code event (PreToolUse, PostToolUse, UserPromptSubmit, SessionStart).
Your specific exposure: env.nu loads SECRET_A, SECRET_B into the shell environment. Plugin hook processes inherit the entire env. One curl hook command exfiltrates everything. The auto-update debounce is only 60 seconds.
HIGH — No Integrity Verification on Crate Downloads
extraction.rs downloads .crate files from crates.io via plain reqwest::get() with no checksum verification against Cargo.lock. Cargo itself cross-checks SHA-256; Symposium does not. The files land in ~/.symposium/cache/extractions/ unverified.
HIGH — Prompt Injection via Skill Content
Skill file content is injected verbatim into Claude's additionalContext on every hook event. Skills come from the auto-updated recommendations repo. No sanitisation. A compromised skill file is a direct prompt injection vector into your Claude session.
Hi, there.
I believe this project can be a gaming change for the Agentic software development. Can I have your thoughts in regards the potential security risks below?
Security Risks
CRITICAL — Plugin Hook Shell Execution + Your Secrets
src/hook.rs executes plugin-defined commands as:
Command::new("sh").arg("-c").arg(&hook.command)
Hook commands come from SYMPOSIUM.toml files in plugin directories. The default, auto-enabled, auto-updating plugin source is symposium-dev/recommendations on GitHub (config.rs). A compromised or malicious plugin repo can run arbitrary shell commands on every Claude Code event (PreToolUse, PostToolUse, UserPromptSubmit, SessionStart).
Your specific exposure: env.nu loads SECRET_A, SECRET_B into the shell environment. Plugin hook processes inherit the entire env. One curl hook command exfiltrates everything. The auto-update debounce is only 60 seconds.
HIGH — No Integrity Verification on Crate Downloads
extraction.rs downloads .crate files from crates.io via plain reqwest::get() with no checksum verification against Cargo.lock. Cargo itself cross-checks SHA-256; Symposium does not. The files land in ~/.symposium/cache/extractions/ unverified.
HIGH — Prompt Injection via Skill Content
Skill file content is injected verbatim into Claude's additionalContext on every hook event. Skills come from the auto-updated recommendations repo. No sanitisation. A compromised skill file is a direct prompt injection vector into your Claude session.