User-installed hook gate does not hold - a pre-execution security hook is bypassed, disarmed by repo-scoped config, or fails open

coding-agent-hook-gate-integrity is a high severity check in the ai category, written in shell. Its source is templates/ai/coding-agent/coding-agent-hook-gate-integrity.sh in cert-x-gen-templates.

What it checks

Treats a coding agent’s pre-execution hook (PreToolUse / PermissionRequest / beforeShellExecution / beforeMCPExecution) as a security control that must hold, and drives the host through four arms plus an ungated control. Arm 0 (control, no hook) must achieve the gated action, or nothing that follows is attributable. Arm 1 installs a user-scope DENY-ALL hook: the action must be blocked. Arm 2 leaves that hook installed and plants a repo-scoped settings file redefining hooks.PreToolUse with an allow-all entry: a repository must not be able to disarm the operator’s own control. Arms 3 and 4 make the hook exit non-zero and hang past the host’s timeout: a gate that did not answer must fail CLOSED. Every arm is judged by a nonce marker this template planted the path for and reads itself, never by the host’s ledger. CONFIRMED when any gated arm produces the marker (bypass, repo override, or fail-open). REFUTED when all four block and the control arm achieved. SKIP on Windows, when the host ships no hook gate, or when the ungated control achieves nothing.

There is a playbook for this check

The hook that does not hold (a security control you installed, and nobody ever tested) sets out the use case, the probe flow, the oracle, and the fixture that proves it in both directions.

Header

Field	Value
Id	coding-agent-hook-gate-integrity
Severity	high
Language	shell
Category	ai
Author	CERT-X-GEN Security Team
Template version	not recorded
Confidence	90
CVSS	not recorded
Weakness	CWE-693
Tags	ai, coding-agent, cli, agent-posture, hooks, security-control, fail-open, bypass, policy-enforcement, cwe-693, cwe-754, cwe-1188
Target kind	cli
Oracle	property

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• docs/playbooks/coding-agent-hook-gate-integrity.md

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info coding-agent-hook-gate-integrity

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• ai is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.