# Build Claude Code Hook Workflows

Claude Code hooks can be hard to configure safely across events. This skill guides hook formats, validation patterns, testing, and migration to prompt-based workflows.

## Install

```bash
npx skillstore add anthropics/hook-development
```

## Metadata

- Status: approved
- Slug: hook-development
- Version: 0.1.0
- Author version: 0.1.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: 5fcbad83becd6841b35f0932f480c8ee79f0c54dd276d5f4ccd242cde6c2f01c
- Author: anthropics
- GitHub username: anthropics
- License: MIT
- Repository: https://github.com/anthropics/claude-code/tree/main/plugins/plugin-dev/skills/hook-development
- Ref: 6e2dddf587274c5f8c929a916ca092529545819b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/hook-development
- Manifest: https://skillstore.pages.dev/api/skills/hook-development/manifest

## Capabilities

- Explains Claude Code hook event types and configuration formats.
- Provides prompt-based and command hook examples for validation.
- Shows patterns for file safety, bash command checks, test enforcement, and context loading.
- Includes scripts to lint hook scripts, test hooks, and validate hook configuration JSON.
- Covers migration from bash-based hooks to prompt-based hooks.

## Use Cases

- Add pre-flight tool validation: Create PreToolUse hooks that review bash commands, file writes, and sensitive paths before tools run.
- Migrate script hooks: Replace brittle shell checks with prompt hooks that express validation rules in natural language.
- Test hooks before release: Validate hook configuration, run sample event payloads, and inspect hook output before publishing a plugin.

## Prompt Templates

### Create a simple hook

```
Use the Hook Development skill to create a PreToolUse hook that asks before Bash commands with destructive operations. Explain the files to edit.
```

### Validate file writes

```
Use the Hook Development skill to design a Write/Edit hook that blocks system paths, path traversal, and credential files. Include testing steps.
```

### Migrate an existing hook

```
Use the Hook Development skill to convert this command hook into a prompt-based hook. Preserve safety rules and list edge cases to test: [paste hook].
```

### Design a hook suite

```
Use the Hook Development skill to design a plugin hook suite with PreToolUse, PostToolUse, Stop, and SessionStart hooks. Include validation, observability, and rollback guidance.
```

## Limitations

- Does not install or activate hooks automatically.
- Examples require shell, jq, and Claude Code hook support.
- Prompt-based hook decisions depend on model behavior and careful prompt design.
- Some advanced examples need security hardening before production use.

## Best Practices

- Start with prompt hooks for contextual security decisions and use command hooks for deterministic checks.
- Quote shell variables, validate input, and test hooks with representative event payloads.
- Restart Claude Code after hook changes and verify behavior with debug logs.

## Anti Patterns

- Do not pass raw untrusted content into security prompts without delimiters and denial criteria.
- Do not log complete hook inputs to external systems or local files without redaction.
- Do not build test commands with shell strings that include untrusted paths.

## Security Audit

- Audited at: 2026-07-19T09:11:58.144\+00:00
- Summary: Most static alerts are false positives caused by Markdown formatting, shebangs, defensive deny checks, and test fixtures. Confirmed risks include shell injection in the test runner, unsafe jq filter construction, and predictable temporary files. Semantic review also found prompt-injection exposure, fail-open validators, SQL injection, sensitive logging, and unpinned package execution.

## Stats

- Views: 259
- Downloads: 18
- Favorites: 0
- Popularity score: 0