hookcheck

Persistence hook auditor: scan repos for auto-exec hooks, flag Shai-Hulud patterns.