From @bergwolf:

I think we must validate the hook commands (e.g., with a configurable command binary whitelist) before really executing any of them. For example, imagine a public container cloud provider that runs kata containers inside, and then here comes a user who creates a container with rm -rf / in the OCI spec hook. BOOM!
It looks like runc does not handle it either. But kata is supposed to be more secure than runc. :)