Postman's Codex plugin installer approves its own session-start hook, its README says

The reporter says that opening Postman desktop 12.33.4 was followed by changes to Codex and Claude Code. Postman's own log, as quoted in the issue, records an "auto-existing-upgrade" install on October 24 with results "claude-code:installed" and "codex:installed". The reporter says this has not been reproduced on a clean Mac and does not claim any data left the machine. The issue showed no Postman reply, assignee or label when read on November 3. It had been picked up on Hacker News, where the thread stood at 147 points at about 13:00 EST.

The plugin's own repository, at the commit the reporter pinned, confirms the approval step. The Codex installer calls a function whose comment reads "Approves only Postman's current hook after installation", and it writes the hook's hash into Codex's trust record. The README says the same: "There is no separate hook prompt or dump of its instructions." The hook runs at startup, clear and compact, and injects text inside EXTREMELY_IMPORTANT tags telling the agent to load a Postman skill "before responding to any non-trivial API engineering task". That text also says project instruction files such as AGENTS.md and CLAUDE.md, and direct requests, take precedence.

Why it matters: Codex tracks a trust status for each hook, and an installer that writes that record itself removes the check for whatever hook it ships. The reporter's evidence puts the record in the hooks.state section of ~/.codex/config.toml, so reading that section is a cheap audit of what your agents run at startup. The approval step is documented by the vendor; the unprompted install rests on one person's log.