Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs `sandpaper install-skill` or uses the local Sandpaper editing UI.
Impact
Hooks influence Claude session context and may block once to request project-brain updates; the editor can modify the selected project document.
Mechanism
Project-scoped Claude hook installation and local AI-assisted file editing.
Rationale
This is an explicit, project-scoped AI-agent extension with meaningful control and editing capability, but inspection found no lifecycle execution, remote payload, credential theft, or unconsented broad control-surface mutation.
Evidence
package.jsonbin/cli.jssrc/setup.jsbin/brain-inject.jsbin/brain-stamp-check.jssrc/claude.jssrc/server.jssrc/path-policy.js.claude/settings.json.claude/commands/sandpaper/.sandpaper/hooks/brain-inject.js.sandpaper/hooks/brain-stamp-check.jsbrain/<document-directory>/.sandpaper/session.json