claude-code-hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-code-hooks (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill guides you through setting up Claude Code hooks with a thorough interview process to ensure the hook configuration exactly matches user requirements.
ALWAYS follow this interview-first approach:
Ask these questions to fully understand the user's needs. Ask 2-3 at a time max to avoid overwhelming them.
| Event | When It Runs | Common Use Cases |
|---|---|---|
PreToolUse | Before any tool executes | Block/allow tools, validate inputs, log commands |
PostToolUse | After tool completes | Auto-format, lint, run tests, notify |
PermissionRequest | When permission dialog shows | Auto-approve safe operations |
UserPromptSubmit | When user submits prompt | Add context, validate prompts |
Notification | When Claude sends notifications | Custom alerts, desktop notifications |
Stop | When Claude finishes responding | Continue work, verify completion |
SubagentStop | When subagent task completes | Validate subagent work |
PreCompact | Before context compaction | Save state, custom summary |
SessionStart | When session begins/resumes | Load context, set env vars |
SessionEnd | When session ends | Cleanup, save logs |
*) or specific ones?"Bash, Write, Edit, Read, Glob, Grep, Task, WebFetch, WebSearchEdit|Write matches both"command type: Run a bash command/scriptprompt type: Use LLM evaluation (only for Stop/SubagentStop)~/.claude/settings.json): Applies to all projects.claude/settings.json): Shared with team.claude/settings.local.json): Personal, not committed$CLAUDE_PROJECT_DIR for project-relative pathsBefore proceeding, summarize back:
Based on our discussion, here's what I'll set up:
- **Hook Event**: [event name]
- **Matcher**: [pattern or "all tools"]
- **Action**: [what the hook does]
- **Implementation**: [command/prompt and what it does]
- **Output Behavior**: [what happens on success/failure]
- **Storage Location**: [which settings file]
Does this match what you need? Any adjustments?{
"hooks": {
"EventName": [
{
"matcher": "ToolPattern",
"hooks": [
{
"type": "command",
"command": "your-command-here",
"timeout": 60
}
]
}
]
}
}UserPromptSubmit, Stop, SubagentStop, Notification, SessionStart, SessionEnd, PreCompact don't use matchers:
{
"hooks": {
"UserPromptSubmit": [
{
"hooks": [
{
"type": "command",
"command": "/path/to/validator.py"
}
]
}
]
}
}CRITICAL: Never corrupt existing settings files.
# Check if settings file exists
if [ -f ".claude/settings.json" ]; then
echo "Existing settings found"
else
echo "No existing settings"
fiUse the provided scripts/apply_hooks.py script:
python3 "$SKILL_DIR/scripts/apply_hooks.py" \
--settings-file ".claude/settings.json" \
--hook-event "PostToolUse" \
--matcher "Edit|Write" \
--command "npx prettier --write \"\$(jq -r '.tool_input.file_path')\"" \
--timeout 30Or use scripts/apply_hooks_json.py for full JSON input:
echo '{"hooks":{"PostToolUse":[...]}}' | python3 "$SKILL_DIR/scripts/apply_hooks_json.py" --settings-file ".claude/settings.json"See references/hook-recipes.md for tested, ready-to-use configurations including:
See references/hook-io-reference.md for complete documentation on:
If hooks aren't working:
/hooks in Claude Codeclaude --debug for detailed output~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.