hooks-create

SUSPICIOUS: the skill is internally consistent with its purpose of authoring Claude Code hooks, and its external dependencies are mostly official. However, its purpose is inherently high-impact: it writes persistent auto-executing scripts, edits agent settings, and can cause future commands to run or be blocked automatically with the user’s credentials. No clear exfiltration or credential-harvesting path is present, so this is not malware, but it is a medium-risk automation skill that should be reviewed carefully before use.