The Agent Skills Directory

[COMMAND_EXECUTION]: The skill describes the implementation of shell-based hooks (Bash) to automate tasks within the Claude Code environment. While this involves executing scripts, the instructions focus on security-hardened patterns, such as using realpath to prevent directory traversal and head -c to limit input size.
[SAFE]: The documentation promotes security best practices for hook authoring, including rejecting filenames that start with dashes to prevent flag injection and avoiding the use of eval or unquoted variable interpolation.
[SAFE]: The skill references an MCP tool cc_kb_hook_recipe(name) for fetching predefined automation recipes. This is a mechanism for retrieving configuration and scripts through the agent's standard tool interface rather than an unverified external source.
[INDIRECT_PROMPT_INJECTION]: The skill describes how hooks can inject context into an agent's session (Category 8). It provides structural guidance on how to safely handle this by using dedicated output fields like additionalContext, while providing templates that validate input before processing.

cc-hook-authoring