GHSA-2cp5-h2w9-phhf: 
JavaScript vulnerability analysis and mitigation

Summary

hooks/universal/pre-tool/client-boundary.sh (shipped in the npm package and copied into consumer projects by the analyzer install step) has three weaknesses:

1. Shell command injection (CWE-78). Line 66 runs allowed_expanded=$(eval echo "$allowed") on every non-comment line of $PROJECT_ROOT/.workflow/client/path-allowlist.txt. That file lives in the project being worked on, so a cloned repository that ships it can run shell code when the hook checks a path outside the project root. Reachable only when an operator wires the hook with a path argument.
2. Boundary bypass (CWE-22). Line 47 is a bare string-prefix match: $ROOT-sibling/x and $ROOT/../x are treated as inside the project root.
3. Fail-open wiring. The script reads the path from $1 and never reads the PreToolUse JSON on stdin, so under standard Claude Code wiring the path is empty, resolves to $PROJECT_ROOT/ and the hook exits 0 for every call. docs/HOOKS.md:17 and docs/PLAYBOOK.md:85 claim it blocks access outside the project root. Line 92 also interpolates the raw path into a JSON event line without escaping.

Fix

• Replace the eval with a literal $HOME / ~ prefix expansion; never evaluate allowlist text.
• Read tool_input.file_path from stdin JSON, canonicalise with realpath -m, and compare against $ROOT/ with a trailing separator.
• Escape the event JSON (or build it with node/jq).
• Tests for each case; correct the docs. Found by a static self-audit of the published tarball.