hook-configuration
Facilitates the creation and management of Claude Code hooks for automated workflows and event handling in AI applications.
Install this skill
Security score
The hook-configuration skill was audited on Feb 12, 2026 and we found 14 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 272 | - `${CLAUDE_PLUGIN_ROOT}` - Plugin directory path (plugin hooks only) |
Curl to non-GitHub URL
| 764 | "command": "jq '.' | curl -d @- https://external-log-service.com" |
Access to hidden dotfiles in home directory
| 207 | - **User-level**: `~/.claude/settings.json` (all projects) |
Access to hidden dotfiles in home directory
| 370 | "command": "jq -r '\"\\(.tool_input.command) - \\(.tool_input.description // \\\"No description\\\")\"' | xargs -I {} sh -c 'echo \"$(date \"+%Y-%m-%d %H:%M:%S\") - {}\" >> ~/.claude-audit.log'" |
Access to hidden dotfiles in home directory
| 583 | # ~/.claude/hooks/conditional-formatter.sh |
Access to hidden dotfiles in home directory
| 609 | "command": "~/.claude/hooks/conditional-formatter.sh" |
Access to hidden dotfiles in home directory
| 648 | "command": "jq -r --arg branch \"$(git rev-parse --abbrev-ref HEAD 2>/dev/null)\" --arg ts \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" '{timestamp: $ts, branch: $branch, tool: .tool_name, command: .tool_input. |
Access to hidden dotfiles in home directory
| 771 | "command": "jq -r '{timestamp: now, tool: .tool_name}' >> ~/.local-audit.jsonl" |
Access to .env file
| 45 | - Block edits to sensitive files (.env, production configs) |
Access to .env file
| 313 | # Block edits to .env files |
Access to .env file
| 315 | if [[ "$file_path" == ".env" ]]; then |
Access to .env file
| 316 | echo "ERROR: Cannot edit .env file" >&2 |
Access to .env file
| 351 | 8. ✅ Avoid processing `.env`, `.git`, credentials files |
External URL reference
| 764 | "command": "jq '.' | curl -d @- https://external-log-service.com" |