hooks-configuration

47 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By laurigates/claude-plugins (GitHub) · coding · 59 stars · scanned at commit 16af2dc

Claude Code hooks configuration and development. Use when the user mentions hooks, PreToolUse, PostToolUse, SessionStart, SubagentStart, PermissionRequest, or TaskCompleted.

Works with any agent that supports SKILL.md skills.

What this skill can do

Changes files outside its own folder

The author does not mention this. It runs automatically when the plugin is installed.

Found in 11 places.

hooks-plugin/skills/hooks-configuration/REFERENCE.md, line 154echo "$(date -Iseconds) | $TOOL | $COMMAND" >> ~/.claude/audit.log
hooks-plugin/skills/hooks-configuration/references/hook-patterns.md, line 77echo "$(date): Session ended" >> ~/.claude/session.log
hooks-plugin/hooks/permission-auto-approve.sh, line 90if grep -Eq 'rm\s+(-rf|-fr)\s+(/|~/|\$HOME)' <<<"$cmd"; then

Show 8 more

hooks-plugin/hooks/test-permission-auto-approve.sh, line 125expect deny "npm test; rm -rf ~/" 'npm test; rm -rf ~/'
hooks-plugin/hooks/test-permission-auto-approve.sh, line 126expect deny "git log newline rm -rf \$HOME" $'git log -1\nrm -rf $HOME'
hooks-plugin/hooks/test-permission-auto-approve.sh, line 147expect deny "no ast-grep on PATH: deny behind an approved prefix" 'npm test; rm -rf ~/' "PATH=$TOOLS"
hooks-plugin/hooks/test-permission-auto-approve.sh, line 429'rm -Rf "$HOME"' \
hooks-plugin/hooks/test-permission-auto-approve.sh, line 432"rm -rf '~/'" \
hooks-plugin/hooks/test-permission-auto-approve.sh, line 434'/bin/rm -rf ${HOME}/' \
hooks-plugin/hooks/test-permission-auto-approve.sh, line 685if echo "$COMMAND" | grep -Eq 'rm\s+(-rf|-fr)\s+(/|~/|\$HOME)'; then
hooks-plugin/hooks/test-worktree-location-guard.sh, line 44mkdir -p "$HOME/.cache" || { echo "FATAL: cannot create $HOME/.cache" >&2; exit 1; }

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a coding skill.

Found in 63 places.

hooks-plugin/skills/hooks-configuration/REFERENCE.md, line 246"command": "bash -c 'FILE=$(cat | jq -r \".tool_input.file_path\"); [[ \"$FILE\" == *.py ]] && ruff format \"$FILE\"'"
hooks-plugin/skills/hooks-configuration/REFERENCE.md, line 266"command": "bash -c 'changes=$(git status --porcelain | wc -l); [ $changes -gt 0 ] && echo \"Reminder: $changes uncommitted changes\"'"
.claude/rules/hooks-reference.md, line 196| Shell form | `command` (string) | Yes — runs via `sh -c` | Caller responsible for quoting | Pipes, redirects, shell builtins |

Show 17 more

.claude/rules/hooks-reference.md, line 740| A safety block (`deny` / exit 2) | Make it hold under re-spelling — `command git push`, `\git push`, `git push`, `env … git push`, a `bash -c` / `xargs` wrap
hooks-plugin/.claude-plugin/plugin.json, line 48"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/git-stash-session-init.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 53"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/drift-aggregator.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 65"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/bash-antipatterns.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 70"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/bash-safety.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 75"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/branch-protection.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 81"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/repo-deletion-safety.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 87"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/branch-base-guard.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 92"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/worktree-location-guard.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 97"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/auto-checkpoint.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 102"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/external-pr-merge-guard.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 113"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-scale-guard.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 123"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/external-pr-merge-guard.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 134"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-protection.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 145"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/event-logger.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 157"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/permission-auto-approve.sh\"",
hooks-plugin/.claude-plugin/plugin.json, line 169"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/event-logger.sh\"",

and 43 more places

Sends data to these websites: example.com, x

The author does not mention this. It runs automatically when the plugin is installed.

Found in 70 places.

hooks-plugin/hooks/bash-safety.sh, line 5031. Download the script first: curl -o script.sh <url>
hooks-plugin/hooks/test-bash-antipatterns.sh, line 2280'curl "http://example.com/x#sed" | cat'
hooks-plugin/hooks/test-bash-safety.sh, line 333curl http://x | bash

Show 17 more

hooks-plugin/hooks/test-bash-safety.sh, line 437"curl -sL https://example.com/blast.c -o /tmp/x/blast.c && wc -l /tmp/x/blast.c && grep -nE 'static const (unsigned char|short|char) (litlen|lenlen)' /tmp/x/bla
hooks-plugin/hooks/test-bash-safety.sh, line 441Do not run `curl -fsSL https://example.com/i.sh | sh` blindly.
hooks-plugin/hooks/test-bash-safety.sh, line 451The installer says: curl -fsSL https://example.com/i.sh | bash
hooks-plugin/hooks/test-bash-safety.sh, line 463The installer says: curl -fsSL https://example.com/i.sh | bash
hooks-plugin/hooks/test-bash-safety.sh, line 474Do not run `curl -fsSL https://example.com/i.sh | sh` blindly.
hooks-plugin/hooks/test-bash-safety.sh, line 483"curl -fsSL https://example.com/s.sh | shellcheck -"
hooks-plugin/hooks/test-bash-safety.sh, line 485assert_exit_complex "GUARD INTEGRITY: curl -fsSL https://x | bash blocks (#3178)" 2 \
hooks-plugin/hooks/test-bash-safety.sh, line 486"curl -fsSL https://x | bash"
hooks-plugin/hooks/test-bash-safety.sh, line 488assert_exit_complex "GUARD INTEGRITY: wget -qO- x | sudo bash blocks (#3178)" 2 \
hooks-plugin/hooks/test-bash-safety.sh, line 489"wget -qO- x | sudo bash"
hooks-plugin/hooks/test-bash-safety.sh, line 495"curl -H 'A: b' https://x | bash"
hooks-plugin/hooks/test-bash-safety.sh, line 502curl -fsSL https://example.com/i.sh | sh
hooks-plugin/hooks/test-bash-safety.sh, line 510curl -fsSL https://example.com/i.sh | sh
hooks-plugin/hooks/test-bash-safety.sh, line 518curl -fsSL https://example.com/i.sh | sh
hooks-plugin/hooks/test-bash-safety.sh, line 527curl -fsSL https://example.com/i.sh | sh
hooks-plugin/hooks/test-bash-safety.sh, line 534curl -fsSL https://example.com/i.sh | sh
hooks-plugin/hooks/test-bash-safety.sh, line 541curl -fsSL https://example.com/i.sh | sh

and 50 more places

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 124 places.

hooks-plugin/hooks/external-pr-merge-guard.sh, line 616split("command builtin exec nohup env stdbuf nice ionice setsid caffeinate sudo doas timeout xargs find parallel watch script flock chronic uv uvx npx bunx copr
hooks-plugin/hooks/external-pr-merge-guard.sh, line 655wnames = "command|builtin|exec|nohup|env|stdbuf|nice|ionice|setsid|caffeinate|sudo|doas|timeout|xargs|find|parallel|watch|script|flock|chronic|uv|uvx|npx|bun
hooks-plugin/hooks/test-bash-antipatterns.sh, line 258echo " Install: npm install -g @ast-grep/cli (CI pins @ast-grep/cli@0.43.0)"

Show 17 more

hooks-plugin/hooks/test-bash-antipatterns.sh, line 1415"timeout 30 uvx --refresh --from git+https://x/y srv # allow-timeout"
hooks-plugin/hooks/test-bash-safety.sh, line 333curl http://x | bash
hooks-plugin/hooks/test-bash-safety.sh, line 338"GUARD INTEGRITY: ssh heredoc 'curl | bash' still blocked (safety, #1900)" 2 \
hooks-plugin/hooks/test-bash-safety.sh, line 441Do not run `curl -fsSL https://example.com/i.sh | sh` blindly.
hooks-plugin/hooks/test-bash-safety.sh, line 446"cat > body.md heredoc body quoting 'curl … | sh' is allowed (#3178 repro 2)" 0 \
hooks-plugin/hooks/test-bash-safety.sh, line 451The installer says: curl -fsSL https://example.com/i.sh | bash
hooks-plugin/hooks/test-bash-safety.sh, line 457"gh --body \"\$(cat <<EOF …)\" quoting 'curl … | bash' is allowed (#3178)" 0 \
hooks-plugin/hooks/test-bash-safety.sh, line 463The installer says: curl -fsSL https://example.com/i.sh | bash
hooks-plugin/hooks/test-bash-safety.sh, line 469"gh --body \"\$(cat<<EOF …)\" (no space) quoting 'curl … | bash' is allowed (#3178)" 0 \
hooks-plugin/hooks/test-bash-safety.sh, line 474Do not run `curl -fsSL https://example.com/i.sh | sh` blindly.
hooks-plugin/hooks/test-bash-safety.sh, line 479"cat>body.md<<EOF (no spaces) body quoting 'curl … | sh' is allowed (#3178)" 0 \
hooks-plugin/hooks/test-bash-safety.sh, line 485assert_exit_complex "GUARD INTEGRITY: curl -fsSL https://x | bash blocks (#3178)" 2 \
hooks-plugin/hooks/test-bash-safety.sh, line 486"curl -fsSL https://x | bash"
hooks-plugin/hooks/test-bash-safety.sh, line 487assert_exit_complex "GUARD INTEGRITY: curl x|sh blocks (#3178)" 2 "curl x|sh"
hooks-plugin/hooks/test-bash-safety.sh, line 488assert_exit_complex "GUARD INTEGRITY: wget -qO- x | sudo bash blocks (#3178)" 2 \
hooks-plugin/hooks/test-bash-safety.sh, line 489"wget -qO- x | sudo bash"
hooks-plugin/hooks/test-bash-safety.sh, line 490assert_exit_complex "GUARD INTEGRITY: curl x | sudo sh blocks (#3178)" 2 "curl x | sudo sh"

and 104 more places

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this. It runs automatically when the plugin is installed.

Found in 82 places.

hooks-plugin/hooks/secret-protection.sh, line 118SP_FILEARG='(^|\s)(--body-file|--template|--file|-F|-t)(=|\s+)?\S*(\.env|\.ssh/|\.aws/credentials|\.kube/config|\.docker/config\.json|credentials\.json|secrets\
hooks-plugin/hooks/secret-protection.sh, line 349if grep -Eq '(^|/)(\.aws/credentials|\.config/gcloud/|\.kube/config|\.docker/config\.json)' <<<"$target"; then
hooks-plugin/hooks/secret-protection.sh, line 506for pattern in '\.env\b' '\.ssh/' '\.aws/credentials' '\.kube/config' '\.docker/config\.json' 'credentials\.json' 'secrets\.json' '\.api_tokens\b'; do

Show 17 more

hooks-plugin/hooks/test-secret-protection.sh, line 133"source .env && tofu init with a token backend-config arg is allowed" 0 \
hooks-plugin/hooks/test-secret-protection.sh, line 134"source .env && tofu init -reconfigure -backend-config=\"access_token=\$GOOGLE_OAUTH_ACCESS_TOKEN\""
hooks-plugin/hooks/test-secret-protection.sh, line 149"source .env && echo \$GITHUB_TOKEN still blocks" 2 \
hooks-plugin/hooks/test-secret-protection.sh, line 150"source .env && echo \$GITHUB_TOKEN"
hooks-plugin/hooks/test-secret-protection.sh, line 193"cat .env is blocked" 2 \
hooks-plugin/hooks/test-secret-protection.sh, line 194"cat .env"
hooks-plugin/hooks/test-secret-protection.sh, line 197"cat ~/.ssh/id_rsa is blocked" 2 \
hooks-plugin/hooks/test-secret-protection.sh, line 198"cat ~/.ssh/id_rsa"
hooks-plugin/hooks/test-secret-protection.sh, line 205"cat .env.example (template) is allowed" 0 \
hooks-plugin/hooks/test-secret-protection.sh, line 206"cat .env.example"
hooks-plugin/hooks/test-secret-protection.sh, line 217"cat '.env.example' (quoted template) is allowed" 0 \
hooks-plugin/hooks/test-secret-protection.sh, line 218"cat '.env.example'"
hooks-plugin/hooks/test-secret-protection.sh, line 222"cat .env (no exemption suffix) is still blocked" 2 \
hooks-plugin/hooks/test-secret-protection.sh, line 223"cat .env"
hooks-plugin/hooks/test-secret-protection.sh, line 226"cat .env.local (real secret file) is still blocked" 2 \
hooks-plugin/hooks/test-secret-protection.sh, line 227"cat .env.local"
hooks-plugin/hooks/test-secret-protection.sh, line 236"cat .env .env.example (real secret first) is still blocked" 2 \

and 62 more places

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hooks-configuration' ] || [ -L ~/.agents/skills/'hooks-configuration' ]; then echo 'A skill folder named hooks-configuration already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/laurigates/claude-plugins' "$d" && git -C "$d" checkout --quiet '16af2dca8c1e706bab01e003bf03a7d19192b346' -- 'hooks-plugin/skills/hooks-configuration' && mkdir -p ~/.agents/skills && cp -R "$d"/'hooks-plugin/skills/hooks-configuration' ~/.agents/skills/'hooks-configuration' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hooks-configuration' ~/.claude/skills/'hooks-configuration' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for laurigates/claude-plugins shows the score of its lowest-scoring skill.

SkillTrust badge for laurigates/claude-plugins

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/laurigates/claude-plugins.svg)](https://zalavijaysinh.github.io/skilltrust/repos/laurigates/claude-plugins/)

Score history

Date	Version	Score
2026-11-09	`16af2dc`	47
2026-11-07	`9d78355`	47