{
  "entry": {
    "kind": "vuln",
    "slug": "claude-code-mods-function-hooks-preview-gives-plugin-and-skills-folder",
    "name": "claude-code-mods-function-hooks-preview-gives-plugin-and-skills-folder",
    "vendor": "Claude Code builds with the function-hooks preview enabled",
    "description": "Dash Security (Yuval Fischer) published an analysis on 25 September 2026 of Claude Mods, also called function hooks, a preview feature Anthropic announced on 9 September that is off by default and turned on with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1. A mod is declared through a `modules` entry in a plugin's hooks/hooks.json and, unlike classic hooks that run as separate processes, loads inside the Claude Code process, where it can inspect, rewrite or replace tool arguments and results for the whole session. Mods load from the marketplace plugin cache, from --plugin-dir, --plugin-url or CLAUDE_CODE_PLUGIN_DIRS, from synced claude.ai content, and from ~/.claude/skills and a project's .claude/skills with no install step; project copies load after the workspace-trust dialog, and Dash flags the skills folders as the riskiest source. Capabilities Dash lists for v2.1.277 include process.run, file read and write, session transcripts, unfiltered settings reads, http.fetch, mcp.call with no permission prompt, rewriting tool descriptions and system-prompt sections, hiding agents from the model, and wrapping UI components. Dash demonstrated a proof-of-concept mod that swaps Bitcoin addresses and notes that endpoint tools see only a legitimate Claude process. It frames mods as added reach rather than new code execution, since shell hooks already run with user authority. No CVE; no Anthropic response is reported.",
    "website": "https://dash.security/blog/claude-mods-the-new-attack-surface-built-in",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-25",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "claude-code-mods-function-hooks-preview-gives-plugin-and-skills-folder",
      "aliases": [
        "ti-124"
      ],
      "title": "Claude Code \"Mods\" (Function Hooks) Preview Gives Plugin and Skills-Folder Code In-Process Control of Tools, Prompts, MCP Calls and UI",
      "summary": "Dash Security (Yuval Fischer) published an analysis on 25 September 2026 of Claude Mods, also called function hooks, a preview feature Anthropic announced on 9 September that is off by default and turned on with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1. A mod is declared through a `modules` entry in a plugin's hooks/hooks.json and, unlike classic hooks that run as separate processes, loads inside the Claude Code process, where it can inspect, rewrite or replace tool arguments and results for the whole session. Mods load from the marketplace plugin cache, from --plugin-dir, --plugin-url or CLAUDE_CODE_PLUGIN_DIRS, from synced claude.ai content, and from ~/.claude/skills and a project's .claude/skills with no install step; project copies load after the workspace-trust dialog, and Dash flags the skills folders as the riskiest source. Capabilities Dash lists for v2.1.277 include process.run, file read and write, session transcripts, unfiltered settings reads, http.fetch, mcp.call with no permission prompt, rewriting tool descriptions and system-prompt sections, hiding agents from the model, and wrapping UI components. Dash demonstrated a proof-of-concept mod that swaps Bitcoin addresses and notes that endpoint tools see only a legitimate Claude process. It frames mods as added reach rather than new code execution, since shell hooks already run with user authority. No CVE; no Anthropic response is reported.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code builds with the function-hooks preview enabled",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code builds with the function-hooks preview enabled (CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1); capabilities analysed on v2.1.277. Not a vulnerability.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": true,
      "publishedAt": "2026-09-25",
      "modifiedAt": "2026-09-25",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://dash.security/blog/claude-mods-the-new-attack-surface-built-in"
        }
      ],
      "mitigation": "Check whether CLAUDE_CODE_ENABLE_FUNCTION_HOOKS is set in shell profiles, dev containers and managed environments, and leave it unset where mods are not needed. Search ~/.claude/plugins/cache, ~/.claude/skills and each repository's .claude/skills for plugins whose hooks/hooks.json has a `modules` key. Run `claude plugin validate` to list the events and calls each mod uses and review the source, since scanning can miss a mod that only changes what it passes on; be especially wary of one combining http.fetch with process.run. Administrators can deploy a managed plugin that refuses user-tier mods using both calls, as Dash's sample shows.",
      "detectedByAnomity": true
    }
  }
}