What the reviewer found
SessionStart (startup) runs script/agent/setup.sh, which sources the gitignored .env with 'set -a' (exporting any keys into the environment of what follows), then runs 'bun install --ignore-scripts', 'git submodule update --init --recursive', node packages/shared-skills/scripts/materialize-frontend-refs.mjs and 'bun run build' when dist/index.js is missing; the last two are repo scripts not in the packet. SessionEnd runs script/agent/cleanup-hook.sh, which nohups script/agent/cleanup.sh (also not in the packet) with its log in /tmp; nothing observed is sent off the machine.
unconditional— runs without any action from the userunreviewed-script— runs a script that could not be readcredential-access— reads credentials
What was read
The hook definition and the 2 scripts it runs, fetched from code-yeongyu/oh-my-openagent:
.claude/settings.jsonscript/agent/setup.shscript/agent/cleanup-hook.sh
What the static scan said
The 26-rule scan found nothing in this file; the review read it anyway.
How this review was made
Fable 5.1 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.