When I shell out to a command-line tool, I think about the arguments I pass — not about what it reads on its own
In one sentence config, hooks, and plugin paths sitting in the working directory — files an agent typically has write access to. I hardened the half I could see.