# Build Claude Code Hooks

Hook workflows need safe validation, clear events, and repeatable testing. This skill provides patterns, scripts, and migration guidance for Claude Code hook configurations.

## Install

```bash
npx skillstore add davila7/hook-development
```

## Metadata

- Status: approved
- Slug: davila7-hook-development
- Version: 0.1.0
- Author version: 0.1.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: 5fcbad83becd6841b35f0932f480c8ee79f0c54dd276d5f4ccd242cde6c2f01c
- Author: davila7
- GitHub username: davila7
- License: MIT
- Repository: https://github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/development/hook-development
- Ref: dbe0e719813583400773166a0621f8a9b8185c72
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/davila7-hook-development
- Manifest: https://skillstore.pages.dev/api/skills/davila7-hook-development/manifest

## Capabilities

- Explains Claude Code hook events, matchers, inputs, outputs, and plugin configuration formats.
- Provides prompt hook patterns for safety checks, test enforcement, and task completion review.
- Includes command hook examples for Bash validation, file write checks, and session context loading.
- Documents migration paths from basic shell hooks to context-aware prompt hooks.
- Supplies helper scripts for hook schema validation, hook testing, and script linting.

## Use Cases

- Create Safety Hooks: Design PreToolUse hooks that review file writes, Bash commands, and sensitive paths before tools run.
- Migrate Shell Hooks: Convert brittle Bash checks into prompt hooks that can reason about context and edge cases.
- Test Hook Behavior: Use included validation and test scripts to check hook configuration, output, timeout, and failure behavior.

## Prompt Templates

### Create a Basic Hook

```
Create a Claude Code PreToolUse hook that validates Write and Edit operations. Explain the matcher, hook type, and expected decision output.
```

### Add Command Validation

```
Design a Bash command validation hook for Claude Code. Block destructive commands, ask before privileged commands, and include safe timeout settings.
```

### Migrate to Prompt Hooks

```
Review this existing hook logic and propose a prompt hook version. Preserve the security goal and list migration risks.
```

### Build a Hook Test Plan

```
Create a test plan for a Claude Code hook package. Include schema validation, sample inputs, expected exits, timeout checks, and failure cases.
```

## Limitations

- It does not install hooks or modify user settings automatically.
- Command hook examples require a Unix shell and common tools such as jq.
- Examples must be reviewed and hardened before production use.
- Prompt hook behavior depends on the host tool and configured hook support.

## Best Practices

- Prefer prompt hooks for contextual safety decisions and command hooks for small deterministic checks.
- Quote shell variables, validate JSON input, and set strict timeouts for every command hook.
- Test hooks with representative allow, ask, deny, timeout, and malformed input cases before deployment.

## Anti Patterns

- Do not copy examples that log raw hook input without redaction or user consent.
- Do not build shell commands by interpolating untrusted file paths or script names.
- Do not rely only on simple deny lists for destructive command or sensitive file detection.

## Security Audit

- Audited at: 2026-07-19T09:29:59.369\+00:00
- Summary: Of 308 static alerts, most are false positives caused by Markdown formatting, defensive checks, and documented shell examples. Confirmed risks include shell injection, unsafe temporary files, raw SQL construction, and unredacted audit logging. Recommended prompt and command validators also contain bypass and injection weaknesses.

## Stats

- Views: 211
- Downloads: 12
- Favorites: 1
- Popularity score: 0