Agent skill · Security

hook-development

Use when creating, modifying, or debugging Claude Code hooks — PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification. Covers the plugin `hooks/hooks.json` wrapper format vs. the user `settings.json` direct format, matchers, security patterns, `$CLAUDE_PLUGIN_ROOT` portability, lifecycle limitations, and debugging. Trigger on "add a hook", "validate tool use", "block dangerous commands", "enforce completion", "hook-based automation".

majiayu000github.com/majiayu000GitHub ↗
claude-codeMIT
Install
npx skills add majiayu000/claude-skill-registry --skill hook-development --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

Facts
Files in the skill folder: 2
SKILL.md size: 13 KB
Bundled scripts: none
Path: skills/agent/hook-development/SKILL.md
Open the folder on GitHub →
Where it comes from
Stars: 534
Language: HTML

Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.

From the SKILL.md

# Hook Development for Claude Code Plugins Adapted from [claude-plugins-official/plugin-dev/skills/hook-development](https://github.com/anthropics/claude-plugins-official/tree/main/plugins/plugin-dev/skills/hook-development). Trimmed to what we actually author (our plugin already has 6 event matchers covering 7 hook handlers — see `hooks/hooks.json`). ## Hook types ### Prompt-based (LLM-driven, for complex reasoning) ```json { "type": "prompt", "prompt": "Evaluate if this tool use is appropriate: $TOOL_INPUT", "timeout": 30 } ``` Supported events: `Stop`, `SubagentStop`, `UserPromptSubmit`, `PreToolUse`. Use for: context-aware decisions, flexible evaluation, natural-language reasoning. ### Command (deterministic, for fast checks) ```json { "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/validate.mjs", "timeout": 60 } ``` Use for: fast deterministic validations, file-system ops, external tools, performance-critical paths. **Our convention:** all our command hooks are `.mjs` (Node.js) — see `hooks/pre-bash-destructive-guard.mjs`, `hooks/enforce-scope.mjs`. The v3.0 migration moved us off bash for native Windows support. ## Configuration formats This is where people trip up

What's inside
Steps it walks through
  1. Hook types
  2. Prompt-based (LLM-driven, for complex reasoning)
  3. Command (deterministic, for fast checks)
  4. Configuration formats
  5. Plugin hooks/hooks.json — wrapper format
  6. User .claude/settings.json — direct format
  7. Hook events
  8. PreToolUse output schema
  9. Stop / SubagentStop output
  10. SessionStart: persist env vars
  11. Input schema
  12. Environment variables
  13. Portability rule
  14. Matchers
Ships with 1 file
  • metadata.json
Commands it runs
echo "export PROJECT_TYPE=nodejs" >> "$CLAUDE_ENV_FILE"
set -euo pipefail
if [[ ! "$tool_name" =~ ^[a-zA-Z0-9_]+$ ]]; then
echo '{"decision": "deny", "reason": "Invalid tool name"}' >&2
exit 2
fi
Deny path traversal
Deny sensitive files
echo "$file_path"        # ✅
cd "$CLAUDE_PROJECT_DIR" # ✅
More from claude-skill-registry
All skills →
About this skill
What does the hook-development skill do?

Use when creating, modifying, or debugging Claude Code hooks — PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification. Covers the plugin `hooks/hooks.json` wrapper format vs. the user `settings.json` direct format, matchers, security patterns, `$CLAUDE_PLUGIN_ROOT` portability, lifecycle limitations, and debugging. Trigger on "add a hook", "validate tool use", "block dangerous commands", "enforce completion", "hook-based automation".

How do I install it?

Run `npx skills add majiayu000/claude-skill-registry --skill hook-development --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.

Where does this skill come from?

From majiayu000/claude-skill-registry, a repository with 534 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.

Is a popular skill a good skill?

Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.

Keep going