技能 Hook Development
📦
Hook Development
v0.1.0 内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🔑 环境变量🌐 网络访问
构建 Claude Code Hook 工作流
Claude Code hooks 在不同事件中可能很难安全配置。此技能会指导 hook 格式、验证模式、测试，以及迁移到基于提示词的工作流。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "Hook Development" from https://skillstore.io/skills/hook-development.md and its manifest at https://skillstore.io/api/skills/hook-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“Hook Development”。 创建一个在 Write 操作运行前审查它们的 hook。
预期结果:
包含 PreToolUse matcher、安全标准、超时指南和测试场景的计划。
正在使用“Hook Development”。 将 bash 验证 hook 迁移到 prompt hooks。
预期结果:
- 旧检查的摘要
- Prompt hook 验证标准
- 迁移和测试清单
正在使用“Hook Development”。 发布前检查我的 hook 配置。
预期结果:
对事件名称、hook 类型、matchers、超时值和重启要求的审查。
安全审计
高风险v10 • 2026/7/19 打开版本化报告
Most static alerts are false positives caused by Markdown formatting, shebangs, defensive deny checks, and test fixtures. Confirmed risks include shell injection in the test runner, unsafe jq filter construction, and predictable temporary files. Semantic review also found prompt-injection exposure, fail-open validators, SQL injection, sensitive logging, and unpinned package execution.
11
已扫描文件
2,781
分析行数
21
复核项
0
已忽略误报
已确认安全问题 (6)
高
Prompt-Based Authorization Is Injection-Prone
Security prompts interpolate untrusted tool commands and input directly into authorization instructions. Crafted tool input can instruct the model to ignore policy and approve a dangerous operation.
The examples directly place $TOOL_INPUT.command or $TOOL_INPUT inside prompts that return permission decisions, without isolation or injection-resistant handling.
高
Command Validator Fails Open on Deny-List Bypasses
The Bash validator blocks a few literal substrings and approves every unmatched command. Equivalent destructive syntax, wrappers, aliases, and encoded commands can bypass the checks.
The code contains only three narrow checks and ends with unconditional approval, while the documented security goal is to block dangerous commands.
高
Write Validator Does Not Resolve Effective Paths
The write validator checks raw path substrings but never canonicalizes paths or resolves symlinks. A permitted path can still target a protected or sensitive file.
The implementation compares the supplied string directly and then approves it; no realpath, directory boundary, or symlink check is present.
高
Untrusted Hook Input Is Concatenated into SQL
The database logging example places raw hook input inside a quoted INSERT statement. A single quote in input can alter the SQL and execute unintended database operations.
The psql command constructs SQL by directly interpolating the complete stdin value, with no parameter binding or escaping.
高
Audit Example Persists Raw Potentially Sensitive Input
The audit example appends complete hook input to a persistent home-directory log. Tool input can contain source code, prompts, credentials, or other sensitive values.
The example writes the full input value without redaction, filtering, retention controls, or explicit restrictive file permissions.
中
Automatic Hook Runs an Unpinned Package Command
The quality hook invokes npx eslint automatically after file edits. Dependency resolution can execute untrusted project binaries or fetch package code outside a pinned toolchain.
The documented PostToolUse pattern runs npx from the active project without pinning the executable or requiring an installed trusted binary.
能力复核项 (21)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Shell command substitution
output=$(timeout "$TIMEOUT" bash -c "cat '$TEST_INPUT' | $HOOK_SCRIPT" 2>&1)
The script inserts caller-controlled file paths into a bash -c command string. A crafted existing filename can break quoting and execute additional shell commands.
中
Temp directory access
echo "$risk_level" > /tmp/hook-state-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
risk_level=$(cat /tmp/hook-state-$$ 2>/dev/null || echo "unknown")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
cache_file="/tmp/hook-cache-$cache_key"
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
echo "0" > /tmp/test-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
echo "0" > /tmp/build-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
count=$(cat /tmp/test-count-$$ 2>/dev/null || echo "0")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
echo $((count + 1)) > /tmp/test-count-$$
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
test_count=$(cat /tmp/test-count-$$ 2>/dev/null || echo "0")
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
rate_file="/tmp/hook-rate-$$"
The example uses a predictable shared /tmp pathname for mutable hook state. Another local process can precreate or replace it, enabling state tampering or symlink-based file clobbering.
中
Temp directory access
export CLAUDE_ENV_FILE="${CLAUDE_ENV_FILE:-/tmp/test-env-$$}"
The default environment file uses a predictable PID-based path in shared /tmp. A local attacker can race or precreate a symlink before the tested hook writes to it.
中
Shell command substitution
for event in $(jq -r 'keys[]' "$HOOKS_FILE"); do
Event names from the supplied JSON are iterated through unquoted command substitution. Whitespace and glob characters can split or alter names, causing validation bypasses.
中
Shell command substitution
for event in $(jq -r 'keys[]' "$HOOKS_FILE"); do
Event names from the supplied JSON are iterated through unquoted command substitution. Whitespace and glob characters can split or alter names, causing validation bypasses.
中
Shell command substitution
hook_count=$(jq -r ".\"$event\" | length" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
matcher=$(jq -r ".\"$event\"[$i].matcher // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
hooks=$(jq -r ".\"$event\"[$i].hooks // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
hook_array_count=$(jq -r ".\"$event\"[$i].hooks | length" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
hook_type=$(jq -r ".\"$event\"[$i].hooks[$j].type // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
command=$(jq -r ".\"$event\"[$i].hooks[$j].command // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
prompt=$(jq -r ".\"$event\"[$i].hooks[$j].prompt // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
中
Shell command substitution
timeout=$(jq -r ".\"$event\"[$i].hooks[$j].timeout // empty" "$HOOKS_FILE")
The untrusted event name is interpolated into jq source code instead of passed with --arg. Crafted keys can change the jq filter and corrupt validation results.
风险因素
⚙️ 外部命令 (50)
examples/load-context.sh:1 examples/validate-bash.sh:8 examples/validate-bash.sh:11 examples/validate-bash.sh:1 examples/validate-write.sh:8 examples/validate-write.sh:11 examples/validate-write.sh:1 references/advanced.md:36 references/advanced.md:37 references/advanced.md:63 references/advanced.md:81 references/advanced.md:92 references/advanced.md:93 references/advanced.md:96 references/advanced.md:105 references/advanced.md:125 references/advanced.md:174 references/advanced.md:175 references/advanced.md:176 references/advanced.md:181 references/advanced.md:244 references/advanced.md:245 references/advanced.md:248 references/advanced.md:250 references/advanced.md:251 references/advanced.md:259 references/advanced.md:273 references/advanced.md:274 references/advanced.md:291 references/advanced.md:304 references/advanced.md:305 references/advanced.md:319 references/advanced.md:320 references/advanced.md:324 references/advanced.md:327 references/advanced.md:328 references/advanced.md:335 references/advanced.md:353 references/advanced.md:354 references/advanced.md:355 references/advanced.md:367 references/advanced.md:368 references/advanced.md:388 references/advanced.md:396 references/advanced.md:414 references/advanced.md:462 references/advanced.md:470 references/advanced.md:35 references/advanced.md:55 references/advanced.md:74
📁 文件系统访问 (45)
examples/validate-bash.sh:31 examples/validate-write.sh:26 references/advanced.md:358 references/advanced.md:358 references/advanced.md:105 references/advanced.md:181 references/advanced.md:250 references/advanced.md:259 references/advanced.md:281 references/advanced.md:295 references/advanced.md:97 references/advanced.md:105 references/advanced.md:177 references/advanced.md:237 references/advanced.md:238 references/advanced.md:250 references/advanced.md:251 references/advanced.md:259 references/advanced.md:323 references/advanced.md:413 references/advanced.md:419 references/migration.md:117 references/migration.md:165 references/patterns.md:268 references/patterns.md:306 scripts/README.md:86 scripts/README.md:89 scripts/test-hook.sh:155 scripts/test-hook.sh:227 scripts/test-hook.sh:34 scripts/test-hook.sh:35 scripts/test-hook.sh:40 scripts/test-hook.sh:50 scripts/test-hook.sh:51 scripts/test-hook.sh:63 scripts/test-hook.sh:64 scripts/test-hook.sh:75 scripts/test-hook.sh:76 scripts/test-hook.sh:87 scripts/test-hook.sh:88 scripts/test-hook.sh:171 scripts/test-hook.sh:173 scripts/validate-hook-schema.sh:32 SKILL.md:534 SKILL.md:550
🔑 环境变量 (1)
🌐 网络访问 (1)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/hook-development/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/hook-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/hook-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/hook-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/hook-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
anthropics. (2026). Hook Development security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/hook-development/audits/10BibTeX 引用
@techreport{anthropics-hook-development-2026,
author = {anthropics},
title = {Hook Development security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/hook-development/audits/10},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Hook Development security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "anthropics"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/hook-development/audits/10"
identifiers:
- type: other
value: "skillstore:hook-development:audit:10"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 使用量更高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
Skillstore 评分
评分依据 证据置信度: 中 68
架构
100
可维护性
87
内容
71
社区
65
规范符合性
你能构建什么
添加预检工具验证
创建 PreToolUse hooks，在工具运行前审查 bash 命令、文件写入和敏感路径。
迁移脚本 hooks
用以自然语言表达验证规则的 prompt hooks 替换脆弱的 shell 检查。
发布前测试 hooks
验证 hook 配置、运行示例事件 payload，并在发布插件前检查 hook 输出。
试试这些提示
创建一个简单 hook
使用 Hook Development 技能创建一个 PreToolUse hook，在包含破坏性操作的 Bash 命令执行前发出询问。说明需要编辑的文件。
验证文件写入
使用 Hook Development 技能设计一个 Write/Edit hook，用于阻止系统路径、路径遍历和凭据文件。包括测试步骤。
迁移现有 hook
使用 Hook Development 技能将此 command hook 转换为基于提示词的 hook。保留安全规则并列出要测试的边界情况：[paste hook]。
设计一套 hooks
使用 Hook Development 技能设计一套插件 hook 组合，包含 PreToolUse、PostToolUse、Stop 和 SessionStart hooks。包括验证、可观测性和回滚指南。
最佳实践
- 针对上下文相关的安全决策从 prompt hooks 开始，并将 command hooks 用于确定性检查。
- 为 shell 变量加引号，验证输入，并使用代表性事件 payload 测试 hooks。
- 在 hook 变更后重启 Claude Code，并通过 debug logs 验证行为。
避免
- 不要在没有分隔符和拒绝标准的情况下，将原始不受信任内容传入安全提示词。
- 不要在未脱敏的情况下，将完整 hook 输入记录到外部系统或本地文件。
- 不要使用包含不受信任路径的 shell 字符串来构建测试命令。
常见问题
此技能会自动创建 hooks 吗？
不会。它为创建 Claude Code hooks 的开发者提供指南、示例和辅助脚本。
它涵盖哪些 hook 事件？
它涵盖 PreToolUse、PostToolUse、Stop、SubagentStop、SessionStart、SessionEnd、UserPromptSubmit、PreCompact 和 Notification。
我应该什么时候使用 prompt hooks？
当验证需要上下文、意图分析或灵活的策略推理时，使用 prompt hooks。
我应该什么时候使用 command hooks？
将 command hooks 用于快速确定性检查、本地工具集成或简单文件检查。
示例需要哪些工具？
shell 示例假定使用 bash、jq，以及提供 hook 事件 payload 的 Claude Code 环境。
这些示例可直接用于生产吗？
它们是起点。生产使用前，请审查日志记录、shell 引用、提示词注入防护和密钥处理。
开发者详情
作者
anthropics许可证
MIT
作者版本
v0.1.0
Skillstore 修订
r1
引用
6e2dddf587274c5f8c929a916ca092529545819b
维护新鲜度
2026/7/18
使用量
17 次下载 · 259 次浏览
文件结构