The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/test-hook.sh utility executes hook scripts provided as command-line arguments. This is an intended feature of the development toolkit to allow developers to validate their scripts locally before deployment.
[INDIRECT_PROMPT_INJECTION]: The skill documents the creation of prompt-based hooks that ingest untrusted data such as $TOOL_INPUT, $TOOL_RESULT, and $TRANSCRIPT_PATH. The provided examples interpolate these variables directly into prompts to perform security and quality checks. While this introduces an injection surface, the documentation includes mitigation strategies like using specific return tokens (e.g., 'approve'/'deny') and performing deterministic checks in bash.
[EXTERNAL_DOWNLOADS]: The references/advanced.md file contains examples demonstrating how to integrate hooks with external services like Slack using curl. These are presented as educational patterns for building notifications and audit logs rather than active or hidden network operations.

hook-development