Add hook hijacking detection for Claude Code (CVE-2025-59536)

[debu-sinha]

Closes #56

What changed

Added hook hijacking detection to the installation scanner. Detects malicious hooks in .claude/settings.json, .claude/settings.local.json, and .claude/hooks/ directory.

New checks

• CHK-001: Project-level security overrides (bypassPermissions, dangerouslyDisableSandbox, autoApprove)
• CHK-002: Unrestricted Bash wildcard permissions in project settings
• CHK-003: Hooks with network exfiltration commands (curl, wget, nc, requests)
• CHK-004: Hooks reading sensitive files or environment variables
• CHK-005: Hooks modifying security configuration (CVE-2025-53773 pattern)

OWASP mapping

• ASI01 (Goal Hijack): hooks executing attacker commands
• ASI02 (Excessive Agency): unrestricted Bash permissions
• ASI05 (Privilege Compromise): credential access from hooks
• ASI06 (Memory Manipulation): security config tampering

Testing

Tested against a malicious fixture with:

• PreToolUse hook with curl + SSH key exfiltration
• PostToolUse hook with nc + env var exfiltration
• Hook script with curl + SSH key theft
• bypassPermissions override in project settings
• Bash(*) wildcard permission

Result: 4 CRITICAL + 4 HIGH findings detected. Security grade F (12/100).

In general, an empty except should either (a) handle the error in a meaningful way (e.g., logging, fallback behavior, metrics) or (b) narrow the caught exception and re-raise if it cannot be safely ignored. Here, the scanner should not crash if a single settings file is unreadable, but it also should not fail silently.

Best minimal fix without changing existing functionality: keep the behavior of “no findings if the file is unreadable/unparsable”, but add a log entry inside the except block explaining that the project settings at project_settings could not be processed and why. We already have a logger defined at the top of the file, so we can reuse it without new imports. We should log at warning (or possibly debug); given this is an unexpected I/O/JSON failure on a security config, warning is reasonable and visible but not fatal.

Concretely, in src/agentsec/scanners/installation.py, in the _scan_hook_hijacking method region around lines 2156–2216, replace:

            except (json.JSONDecodeError, OSError):
                pass

with something like:

            except (json.JSONDecodeError, OSError) as exc:
                logger.warning(
                    "Failed to read or parse project settings at %s: %s",
                    project_settings,
                    exc,
                )

This maintains flow (no exception is propagated) but removes the empty except and improves diagnosability.