Token导航 LogoToken导航TokenDH.com
开发执行命令github未标认证来源可访问许可证需确认审计提醒

hook-authoring挂钩创作

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

499

周安装

21

GitHub Stars

12

下载量

175
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

2

许可证

unknown

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:hook-authoring(挂钩创作)
来源仓库:https://github.com/claude-dev-suite/claude-dev-suite
仓库路径:skills/hook-authoring
安装命令:
npx skills add https://github.com/claude-dev-suite/claude-dev-suite --skill hook-authoring
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/claude-dev-suite/claude-dev-suite --skill hook-authoring

简介

用于生命周期钩子设计与确定性行为注入,避免 LLM 随机决策。

  • 支持 shell 命令、LLM 提示与条件判断组合执行。
  • 可应用于代码格式化、依赖检查与安全扫描等场景。
  • 配置文件应区分项目级与全局作用域,敏感命令需脱敏处理。
  • hook-authoring 属于开发类 Skill,可作为该场景下的辅助能力补充。

SKILL.md

Hook Authoring — Official Best Practices

What Hooks Do

Hooks are deterministic shell commands (or LLM prompts) that execute at specific lifecycle points. They provide guaranteed behavior — not relying on the LLM to choose to run them.

Configuration Locations

LocationScopeShareable
~/.claude/settings.jsonAll projectsNo
.claude/settings.jsonSingle projectYes (commit)
.claude/settings.local.jsonSingle projectNo (gitignored)
Agent/skill frontmatterWhile component activeYes
Plugin hooks/hooks.jsonWhen plugin enabledYes

Hook Types

TypeHow it worksUse when
commandRuns shell command, reads stdin JSON, uses exit codesDeterministic validation, formatting, logging
promptSingle-turn LLM call, returns {ok, reason}Judgment-based decisions without tool access
agentMulti-turn subagent with tool accessVerification requiring file reads or commands
httpPOSTs event data to URL endpointExternal service integration, audit logging

Hook Events

See quick-ref/events-reference.md for full input/output schemas.

EventMatcher inputCan block?Common use
SessionStartstartup/resume/clear/compactNoRe-inject context after compaction
UserPromptSubmit(none)YesValidate/transform user input
PreToolUseTool nameYesBlock commands, validate operations
PermissionRequestTool nameYesAuto-allow/deny permissions
PostToolUseTool nameNo*Auto-format files, logging
PostToolUseFailureTool nameNoError handling
NotificationNotification typeNoDesktop alerts
SubagentStartAgent typeNoSetup before agent runs
SubagentStopAgent typeNoCleanup after agent
Stop(none)YesVerify completeness
ConfigChangeConfig sourceYesAudit, block unauthorized changes
PreCompactmanual/autoNoSave context before compaction
SessionEndExit reasonNoCleanup

*PostToolUse Stop hooks can return {"decision": "block"} to keep Claude working.

Configuration Format

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "jq -r '.tool_input.file_path' | xargs npx prettier --write",
            "timeout": 30
          }
        ]
      }
    ]
  }
}

Input/Output Protocol

Input (stdin JSON)

Every hook receives JSON on stdin with common fields + event-specific data:

{
  "session_id": "abc123",
  "cwd": "/path/to/project",
  "hook_event_name": "PreToolUse",
  "tool_name": "Bash",
  "tool_input": { "command": "npm test" }
}

Output (exit codes)

Exit codeEffect
0Allow — action proceeds. Stdout added to context (SessionStart, UserPromptSubmit)
2Block — action cancelled. Stderr sent to Claude as feedback
OtherAllow — stderr logged (visible in verbose mode Ctrl+O)

Structured JSON output (exit 0 + JSON on stdout)

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "Use rg instead of grep"
  }
}

PreToolUse decisions: "allow", "deny", "ask".

Common Patterns

Auto-format after edits

{
  "PostToolUse": [{
    "matcher": "Edit|Write",
    "hooks": [{ "type": "command", "command": "jq -r '.tool_input.file_path' | xargs npx prettier --write" }]
  }]
}

Block protected files

#!/bin/bash
INPUT=$(cat)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
for pattern in ".env" "package-lock.json" ".git/"; do
  if [[ "$FILE" == *"$pattern"* ]]; then
    echo "Blocked: matches protected pattern '$pattern'" >&2
    exit 2
  fi
done
exit 0

Re-inject context after compaction

{
  "SessionStart": [{
    "matcher": "compact",
    "hooks": [{ "type": "command", "command": "echo 'Reminder: use Bun, not npm. Run tests before commits.'" }]
  }]
}

Notification on idle

{
  "Notification": [{
    "matcher": "",
    "hooks": [{ "type": "command", "command": "osascript -e 'display notification \"Claude needs attention\" with title \"Claude Code\"'" }]
  }]
}

Stop Hook Infinite Loop Prevention

Always check stop_hook_active to avoid loops:

INPUT=$(cat)
if [ "$(echo "$INPUT" | jq -r '.stop_hook_active')" = "true" ]; then
  exit 0  # Let Claude stop
fi
# ... your logic

Anti-Patterns

Anti-PatternFix
Shell profile echo breaks JSONWrap in if [[$- == *i*]]
Stop hook without loop guardCheck stop_hook_active field
Using PostToolUse to undo actionsToo late — use PreToolUse to block instead
Relying on PermissionRequest in headless modeDoesn't fire in -p mode. Use PreToolUse

Checklist

  • Correct event chosen for the use case
  • Matcher pattern tested (case-sensitive, regex)
  • Script is executable (chmod +x)
  • Uses jq for JSON parsing (or Python/Node)
  • Exit code 2 for blocking, 0 for allowing
  • Stop hooks check stop_hook_active
  • Tested with sample JSON piped to stdin
  • Hook script uses absolute paths or $CLAUDE_PROJECT_DIR

Reference

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Codex

33.29%
按下载量换算58

Claude

30.82%
按下载量换算54

Cursor

18.67%
按下载量换算33

Gemini CLI

8.94%
按下载量换算16

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

可疑

权限和风险

执行命令

安装流程涉及命令执行,可能通过 npx skills add https://github.com/claude-dev-suite/claude-dev-suite --skill hook-authoring 联网下载 Skill 或依赖。用户安装前应确认命令来源、仓库内容和执行环境。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。来源安全扫描存在 warning/failed 结果,不能写成本站确认安全。当前只有一个来源,正式发布前建议补源仓库或其他目录站核验。

来源信息

继续浏览同类 Skills