What the reviewer found
Stop runs ./bin/brew lgtm on every stop with a six-minute timeout; bin/brew is Homebrew's own launcher, which reads brew.env config files, strips the environment to an allowlist, and execs Library/Homebrew/brew.sh with the lgtm dev command. The launcher itself is clean, but brew.sh and the lgtm command are not in the packet, so what actually runs on every Stop is unread.
unconditional— runs without any action from the userunreviewed-script— runs a script that could not be read
What was read
The hook definition and the script it runs, fetched from Homebrew/brew:
.claude/settings.jsonbin/brew
What the static scan said
The 26-rule scan found nothing in this file; the review read it anyway.
How this review was made
Fable 5.1 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.