hooks-session-start-hook

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 128 places.

• hooks-plugin/skills/hooks-session-start-hook/REFERENCE.md, line 35{{ poetry install / uv sync / pip install -e '.[dev]' }}
• hooks-plugin/skills/hooks-session-start-hook/REFERENCE.md, line 38pip install -r requirements.txt 2>/dev/null
• hooks-plugin/skills/hooks-session-start-hook/SKILL.md, line 78| `biome.json` / `biome.jsonc` | Biome | `npx biome check .` |

and 108 more places

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a coding skill.

Found in 59 places.

• hooks-plugin/.claude-plugin/plugin.json, line 48"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/git-stash-session-init.sh\"",
• hooks-plugin/.claude-plugin/plugin.json, line 53"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/drift-aggregator.sh\"",
• hooks-plugin/.claude-plugin/plugin.json, line 65"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/bash-antipatterns.sh\"",

and 39 more places

Sends data to these websites: example.com, x

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 70 places.

• hooks-plugin/hooks/bash-safety.sh, line 5031. Download the script first: curl -o script.sh <url>
• hooks-plugin/hooks/test-bash-antipatterns.sh, line 2280'curl "http://example.com/x#sed" | cat'
• hooks-plugin/hooks/test-bash-safety.sh, line 333curl http://x | bash

and 50 more places

Changes files outside its own folder

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 9 places.

• hooks-plugin/hooks/permission-auto-approve.sh, line 90if grep -Eq 'rm\s+(-rf|-fr)\s+(/|~/|\$HOME)' <<<"$cmd"; then
• hooks-plugin/hooks/test-permission-auto-approve.sh, line 125expect deny "npm test; rm -rf ~/" 'npm test; rm -rf ~/'
• hooks-plugin/hooks/test-permission-auto-approve.sh, line 126expect deny "git log newline rm -rf \$HOME" $'git log -1\nrm -rf $HOME'

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 82 places.

• hooks-plugin/hooks/secret-protection.sh, line 118SP_FILEARG='(^|\s)(--body-file|--template|--file|-F|-t)(=|\s+)?\S*(\.env|\.ssh/|\.aws/credentials|\.kube/config|\.docker/config\.json|credentials\.json|secrets\
• hooks-plugin/hooks/secret-protection.sh, line 349if grep -Eq '(^|/)(\.aws/credentials|\.config/gcloud/|\.kube/config|\.docker/config\.json)' <<<"$target"; then
• hooks-plugin/hooks/secret-protection.sh, line 506for pattern in '\.env\b' '\.ssh/' '\.aws/credentials' '\.kube/config' '\.docker/config\.json' 'credentials\.json' 'secrets\.json' '\.api_tokens\b'; do

and 62 more places