Skills Hook Development
📦
Hook Development
v0.1.0 Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access
Build Claude Code Hook Workflows
Claude Code hooks can be hard to configure safely across events. This skill guides hook formats, validation patterns, testing, and migration to prompt-based workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "Hook Development" from https://skillstore.io/skills/hook-development.md and its manifest at https://skillstore.io/api/skills/hook-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "Hook Development". Create a hook that reviews Write operations before they run.
Expected outcome:
A plan with a PreToolUse matcher, safety criteria, timeout guidance, and test scenarios.
Using "Hook Development". Migrate a bash validation hook to prompt hooks.
Expected outcome:
- Summary of the old checks
- Prompt hook validation criteria
- Migration and testing checklist
Using "Hook Development". Check my hook configuration before release.
Expected outcome:
A review of event names, hook types, matchers, timeout values, and restart requirements.
Security Audit
High Riskv10 • 7/19/2026 Open versioned report
Most static alerts are false positives caused by Markdown formatting, shebangs, defensive deny checks, and test fixtures. Confirmed risks include shell injection in the test runner, unsafe jq filter construction, and predictable temporary files. Semantic review also found prompt-injection exposure, fail-open validators, SQL injection, sensitive logging, and unpinned package execution.
11
Files scanned
2,781
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Prompt-Based Authorization Is Injection-Prone
Security prompts interpolate untrusted tool commands and input directly into authorization instructions. Crafted tool input can instruct the model to ignore policy and approve a dangerous operation.
The examples directly place $TOOL_INPUT.command or $TOOL_INPUT inside prompts that return permission decisions, without isolation or injection-resistant handling.
High
Command Validator Fails Open on Deny-List Bypasses
The Bash validator blocks a few literal substrings and approves every unmatched command. Equivalent destructive syntax, wrappers, aliases, and encoded commands can bypass the checks.
The code contains only three narrow checks and ends with unconditional approval, while the documented security goal is to block dangerous commands.
High
Write Validator Does Not Resolve Effective Paths
The write validator checks raw path substrings but never canonicalizes paths or resolves symlinks. A permitted path can still target a protected or sensitive file.
The implementation compares the supplied string directly and then approves it; no realpath, directory boundary, or symlink check is present.
High
Untrusted Hook Input Is Concatenated into SQL
The database logging example places raw hook input inside a quoted INSERT statement. A single quote in input can alter the SQL and execute unintended database operations.
The psql command constructs SQL by directly interpolating the complete stdin value, with no parameter binding or escaping.
High
Audit Example Persists Raw Potentially Sensitive Input
The audit example appends complete hook input to a persistent home-directory log. Tool input can contain source code, prompts, credentials, or other sensitive values.
The example writes the full input value without redaction, filtering, retention controls, or explicit restrictive file permissions.
Medium
Automatic Hook Runs an Unpinned Package Command
The quality hook invokes npx eslint automatically after file edits. Dependency resolution can execute untrusted project binaries or fetch package code outside a pinned toolchain.
The documented PostToolUse pattern runs npx from the active project without pinning the executable or requiring an installed trusted binary.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
output=$(timeout "$TIMEOUT" bash -c "cat '$TEST_INPUT' | $HOOK_SCRIPT" 2>&1)
The script inserts caller-controlled file paths into a bash -c command string. A crafted existing filename can break quoting and execute additional shell commands.
Medium
Temp directory access
echo "$risk_level" > /tmp/hook-state-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
risk_level=$(cat /tmp/hook-state-$$ 2>/dev/null || echo "unknown")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
cache_file="/tmp/hook-cache-$cache_key"
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
echo "0" > /tmp/test-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
echo "0" > /tmp/build-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
count=$(cat /tmp/test-count-$$ 2>/dev/null || echo "0")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
echo $((count + 1)) > /tmp/test-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
test_count=$(cat /tmp/test-count-$$ 2>/dev/null || echo "0")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
rate_file="/tmp/hook-rate-$$"
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
Medium
Temp directory access
export CLAUDE_ENV_FILE="${CLAUDE_ENV_FILE:-/tmp/test-env-$$}"
The default environment file uses a predictable PID-based path in shared /tmp. A local attacker can race or precreate a symlink before the tested hook writes to it.
Medium
Shell command substitution
for event in $(jq -r 'keys[]' "$HOOKS_FILE"); do
Event names from the supplied JSON are iterated through unquoted command substitution. Whitespace and glob characters can split or alter names, causing validation bypasses.
Medium
Shell command substitution
for event in $(jq -r 'keys[]' "$HOOKS_FILE"); do
Event names from the supplied JSON are iterated through unquoted command substitution. Whitespace and glob characters can split or alter names, causing validation bypasses.
Medium
Shell command substitution
hook_count=$(jq -r ".\"$event\" | length" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
matcher=$(jq -r ".\"$event\"[$i].matcher // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
hooks=$(jq -r ".\"$event\"[$i].hooks // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
hook_array_count=$(jq -r ".\"$event\"[$i].hooks | length" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
hook_type=$(jq -r ".\"$event\"[$i].hooks[$j].type // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
command=$(jq -r ".\"$event\"[$i].hooks[$j].command // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
prompt=$(jq -r ".\"$event\"[$i].hooks[$j].prompt // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Medium
Shell command substitution
timeout=$(jq -r ".\"$event\"[$i].hooks[$j].timeout // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
Risk Factors
⚙️ External commands (50)
examples/load-context.sh:1 examples/validate-bash.sh:8 examples/validate-bash.sh:11 examples/validate-bash.sh:1 examples/validate-write.sh:8 examples/validate-write.sh:11 examples/validate-write.sh:1 references/advanced.md:36 references/advanced.md:37 references/advanced.md:63 references/advanced.md:81 references/advanced.md:92 references/advanced.md:93 references/advanced.md:96 references/advanced.md:105 references/advanced.md:125 references/advanced.md:174 references/advanced.md:175 references/advanced.md:176 references/advanced.md:181 references/advanced.md:244 references/advanced.md:245 references/advanced.md:248 references/advanced.md:250 references/advanced.md:251 references/advanced.md:259 references/advanced.md:273 references/advanced.md:274 references/advanced.md:291 references/advanced.md:304 references/advanced.md:305 references/advanced.md:319 references/advanced.md:320 references/advanced.md:324 references/advanced.md:327 references/advanced.md:328 references/advanced.md:335 references/advanced.md:353 references/advanced.md:354 references/advanced.md:355 references/advanced.md:367 references/advanced.md:368 references/advanced.md:388 references/advanced.md:396 references/advanced.md:414 references/advanced.md:462 references/advanced.md:470 references/advanced.md:35 references/advanced.md:55 references/advanced.md:74
📁 Filesystem access (45)
examples/validate-bash.sh:31 examples/validate-write.sh:26 references/advanced.md:358 references/advanced.md:358 references/advanced.md:105 references/advanced.md:181 references/advanced.md:250 references/advanced.md:259 references/advanced.md:281 references/advanced.md:295 references/advanced.md:97 references/advanced.md:105 references/advanced.md:177 references/advanced.md:237 references/advanced.md:238 references/advanced.md:250 references/advanced.md:251 references/advanced.md:259 references/advanced.md:323 references/advanced.md:413 references/advanced.md:419 references/migration.md:117 references/migration.md:165 references/patterns.md:268 references/patterns.md:306 scripts/README.md:86 scripts/README.md:89 scripts/test-hook.sh:155 scripts/test-hook.sh:227 scripts/test-hook.sh:34 scripts/test-hook.sh:35 scripts/test-hook.sh:40 scripts/test-hook.sh:50 scripts/test-hook.sh:51 scripts/test-hook.sh:63 scripts/test-hook.sh:64 scripts/test-hook.sh:75 scripts/test-hook.sh:76 scripts/test-hook.sh:87 scripts/test-hook.sh:88 scripts/test-hook.sh:171 scripts/test-hook.sh:173 scripts/validate-hook-schema.sh:32 SKILL.md:534 SKILL.md:550
🔑 Env variables (1)
🌐 Network access (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/hook-development/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/hook-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/hook-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/hook-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/hook-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
anthropics. (2026). Hook Development security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/hook-development/audits/10BibTeX citation
@techreport{anthropics-hook-development-2026,
author = {anthropics},
title = {Hook Development security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/hook-development/audits/10},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Hook Development security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "anthropics"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/hook-development/audits/10"
identifiers:
- type: other
value: "skillstore:hook-development:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
3 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
hook-development
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 18
Updated
2026-08-21
anthropics-hook-development
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 13
Updated
2026-08-21
davila7-hook-development
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 12
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 68
Architecture
100
Maintainability
87
Content
71
Community
65
Spec Compliance
What You Can Build
Add pre-flight tool validation
Create PreToolUse hooks that review bash commands, file writes, and sensitive paths before tools run.
Migrate script hooks
Replace brittle shell checks with prompt hooks that express validation rules in natural language.
Test hooks before release
Validate hook configuration, run sample event payloads, and inspect hook output before publishing a plugin.
Try These Prompts
Create a simple hook
Use the Hook Development skill to create a PreToolUse hook that asks before Bash commands with destructive operations. Explain the files to edit.
Validate file writes
Use the Hook Development skill to design a Write/Edit hook that blocks system paths, path traversal, and credential files. Include testing steps.
Migrate an existing hook
Use the Hook Development skill to convert this command hook into a prompt-based hook. Preserve safety rules and list edge cases to test: [paste hook].
Design a hook suite
Use the Hook Development skill to design a plugin hook suite with PreToolUse, PostToolUse, Stop, and SessionStart hooks. Include validation, observability, and rollback guidance.
Best Practices
- Start with prompt hooks for contextual security decisions and use command hooks for deterministic checks.
- Quote shell variables, validate input, and test hooks with representative event payloads.
- Restart Claude Code after hook changes and verify behavior with debug logs.
Avoid
- Do not pass raw untrusted content into security prompts without delimiters and denial criteria.
- Do not log complete hook inputs to external systems or local files without redaction.
- Do not build test commands with shell strings that include untrusted paths.
Frequently Asked Questions
Does this skill create hooks automatically?
No. It provides guidance, examples, and helper scripts for developers who create Claude Code hooks.
Which hook events does it cover?
It covers PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, and Notification.
When should I use prompt hooks?
Use prompt hooks when validation needs context, intent analysis, or flexible policy reasoning.
When should I use command hooks?
Use command hooks for fast deterministic checks, local tool integration, or simple file inspections.
What tools do the examples require?
The shell examples assume bash, jq, and a Claude Code environment that provides hook event payloads.
Are the examples production ready?
They are starting points. Review logging, shell quoting, prompt injection defenses, and secret handling before production use.
Developer Details
Author
anthropicsLicense
MIT
Author version
v0.1.0
Skillstore revision
r1
Repository
https://github.com/anthropics/claude-code/tree/main/plugins/plugin-dev/skills/hook-developmentRef
6e2dddf587274c5f8c929a916ca092529545819b
Maintenance freshness
7/21/2026
Usage
17 downloads · 259 views
File structure