The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary purpose is to generate and register bash scripts that execute automatically during agent lifecycle events (e.g., SessionStart, PreToolUse). While this is intended functionality, it establishes a persistence-like mechanism where code is executed on the host system without direct user initiation per event.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by injecting the output of hooks directly into the agent's context. This could allow external data processed by a hook to influence agent behavior.
Ingestion points: Output from bash scripts located in app/hooks/ and responses from http type hooks defined in hooks.json are injected into the agent context.
Boundary markers: The provided templates do not include specific boundary markers or delimiters for hook output.
Capability inventory: The skill utilizes Write, Edit, and Bash tools to create, modify, and validate executable scripts.
Sanitization: The documentation includes rules advising against writing secrets to stdout, but no automated sanitization or filtering is implemented within the skill itself.
[SAFE]: The use of the $HOME/.softspark/ directory for hook storage is consistent with the identified author 'softspark' and represents standard configuration behavior for this toolkit.
[SAFE]: The skill documentation explicitly addresses security best practices, such as warning against credential exposure in hook outputs and advising that Pre* hooks should be fast and deterministic to avoid performance degradation.

hook-creator