hook-development
Audited by Runlayer on Feb 21, 2026
Malicious tool definition detected
Tool: SKILL.md [1/3] Description: --- name: hook-development description: This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance fo
Tool: SKILL.md [2/3] Description: "*", "hooks": [ { "type": "command", "command": "bash ${CLAUDE_PLUGIN_ROOT}/scripts/load-context.sh", "timeout": 10 } ] } ] } ``` Plugin hooks merge with user's hooks and run in parallel.
Tool: SKILL.md [3/3] Description: --debug` for detailed logs - **Validation**: Use `jq` to validate hook JSON output ## Implementation Workflow To implement hooks in a plugin: 1.
Malicious tool definition detected
Tool: examples/load-context.sh Description: #!/bin/bash # Example SessionStart hook for loading project context # This script detects project type and sets environment variables set -euo pipefail # Navigate to project directory cd "$CLAUDE_PROJECT_DIR" || exit 1 echo "Loading project context..." # Detect project type and set environment if [ -f "package.json" ]; then echo "📦 Node.js project detected" echo "export PROJECT_TYPE=nodejs" >> "$CLAUDE_ENV_FILE" # Check if TypeScript if [ -f "tsconfig.
Malicious tool definition detected
Tool: examples/validate-bash.sh Description: #!/bin/bash # Example PreToolUse hook for validating Bash commands # This script demonstrates bash command validation patterns set -euo pipefail # Read input from stdin input=$(cat) # Extract command command=$(echo "$input" | jq -r '.tool_input.command // empty') # Validate command exists if [ -z "$command" ]; then echo '{"continue": true}' # No command to validate exit 0 fi # Check for obviously safe commands (quick approval) if [[ "$command" =~ ^(ls
Malicious tool definition detected
Tool: examples/validate-write.sh Description: #!/bin/bash # Example PreToolUse hook for validating Write/Edit operations # This script demonstrates file write validation patterns set -euo pipefail # Read input from stdin input=$(cat) # Extract file path and content file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty') # Validate path exists if [ -z "$file_path" ]; then echo '{"continue": true}' # No path to validate exit 0 fi # Check for path traversal
Malicious tool definition detected
Tool: references/advanced.md [1/2] Description: # Advanced Hook Use Cases This reference covers advanced hook patterns and techniques for sophisticated automation workflows.
Tool: references/advanced.md [2/2] Description: "ls"}}' | bash validate-bash.sh) if [ $?
Malicious tool definition detected
Tool: references/migration.md [1/2] Description: # Migrating from Basic to Advanced Hooks This guide shows how to migrate from basic command hooks to advanced prompt-based hooks for better maintainability and flexibility.
Tool: references/migration.md [2/2] Description: etc)" ``` ### Pattern: Regex → Intent **Before:** ```bash if [[ "$file" =~ \.(env|secret|key|token)$ ]]; then echo "Credential file" >&2 exit 2 fi ``` **After:** ``` "Verify not writing to credential files (.env, secrets, keys, tokens)" ``` ### Pattern: Multiple Conditions → Criteria List **Before:** ```bash if [ condition1 ] || [ condition2 ] || [ condition3 ]; then echo "Invalid" >&2 exit 2 fi ``` **After:** ``` "Check: 1) condition1 2) conditio
Malicious tool definition detected
Tool: references/patterns.md Description: # Common Hook Patterns This reference provides common, proven patterns for implementing Claude Code hooks. Use these patterns as starting points for typical hook use cases.
Malicious tool definition detected
Tool: scripts/README.md Description: # Hook Development Utility Scripts These scripts help validate, test, and lint hook implementations before deployment.
Malicious tool definition detected
Tool: scripts/hook-linter.sh Description: #!/bin/bash # Hook Linter # Checks hook scripts for common issues and best practices set -euo pipefail # Usage if [ $# -eq 0 ]; then echo "Usage: $0 <hook-script.sh> [hook-script2.sh ...]" echo "" echo "Checks hook scripts for:" echo " - Shebang presence" echo " - set -euo pipefail usage" echo " - Input reading from stdin" echo " - Proper error handling" echo " - Variable quoting" echo " - Exit code usage" echo " - Hardcoded paths" echo " - Timeo
Malicious tool definition detected
Tool: scripts/test-hook.sh Description: #!/bin/bash # Hook Testing Helper # Tests a hook with sample input and shows output set -euo pipefail # Usage show_usage() { echo "Usage: $0 [options] <hook-script> <test-input.json>" echo "" echo "Options:" echo " -h, --help Show this help message" echo " -v, --verbose Show detailed execution information" echo " -t, --timeout N Set timeout in seconds (default: 60)" echo "" echo "Examples:" echo " $0 validate-bash.sh test-input.json" echo " $0
Malicious tool definition detected
Tool: scripts/validate-hook-schema.sh Description: #!/bin/bash # Hook Schema Validator # Validates hooks.json structure and checks for common issues set -euo pipefail # Usage if [ $# -eq 0 ]; then echo "Usage: $0 <path/to/hooks.json>" echo "" echo "Validates hook configuration file for:" echo " - Valid JSON syntax" echo " - Required fields" echo " - Hook type validity" echo " - Matcher patterns" echo " - Timeout ranges" exit 1 fi HOOKS_FILE="$1" if [ !