fix(security): prevent command injection in test-hook.sh

The test-hook.sh script had a command injection vulnerability where
the hook script path was used unquoted in a bash -c context:

  output=$(timeout "$TIMEOUT" bash -c "cat '$TEST_INPUT' | $HOOK_SCRIPT")

This allowed potential code execution if a malicious path was provided.

Changes:
- Add input validation to reject paths with shell metacharacters
- Use a flag to track executable status instead of modifying the path
- Use proper argument passing via bash -c positional parameters
- Arguments are now safely passed as $1 and $2 instead of string concat

The fix uses the pattern:
  bash -c 'cat "$1" | "$2"' -- "$TEST_INPUT" "$HOOK_SCRIPT"

This ensures paths are treated as literal strings, not shell code.

Author: claude

plugins/plugin-dev/skills/hook-development/scripts/test-hook.sh

@@ -141,9 +141,19 @@ if [ ! -f "$HOOK_SCRIPT" ]; then
   exit 1
 fi
 
+# Security: Validate hook script path doesn't contain dangerous characters
+# This prevents potential command injection through maliciously crafted paths
+if [[ "$HOOK_SCRIPT" =~ [\;\|\&\`\$\(\)\{\}\<\>] ]]; then
+  echo "❌ Error: Hook script path contains invalid characters"
+  echo "   Path must not contain: ; | & \` \$ ( ) { } < >"
+  exit 1
+fi
+
+# Track if we need to invoke with bash explicitly
+HOOK_IS_EXECUTABLE=true
 if [ ! -x "$HOOK_SCRIPT" ]; then
   echo "⚠️  Warning: Hook script is not executable. Attempting to run with bash..."
-  HOOK_SCRIPT="bash $HOOK_SCRIPT"
+  HOOK_IS_EXECUTABLE=false
 fi
 
 if [ ! -f "$TEST_INPUT" ]; then
@@ -187,7 +197,13 @@ echo ""
 start_time=$(date +%s)
 
 set +e
-output=$(timeout "$TIMEOUT" bash -c "cat '$TEST_INPUT' | $HOOK_SCRIPT" 2>&1)
+# Use proper argument passing to prevent command injection
+# Arguments are passed safely via bash -c's positional parameters
+if [ "$HOOK_IS_EXECUTABLE" = true ]; then
+  output=$(timeout "$TIMEOUT" bash -c 'cat "$1" | "$2"' -- "$TEST_INPUT" "$HOOK_SCRIPT" 2>&1)
+else
+  output=$(timeout "$TIMEOUT" bash -c 'cat "$1" | bash "$2"' -- "$TEST_INPUT" "$HOOK_SCRIPT" 2>&1)
+fi
 exit_code=$?
 set -e