claude-hook-writer
Provides expert guidance for writing secure and performant Claude Code hooks, ensuring best practices and reliability.
Install this skill
Security score
The claude-hook-writer skill was audited on Mar 4, 2026 and we found 25 security issues across 3 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 173 | ```bash |
Template literal with variable interpolation in command context
| 209 | ```bash |
Template literal with variable interpolation in command context
| 319 | ```bash |
Template literal with variable interpolation in command context
| 387 | ```bash |
Template literal with variable interpolation in command context
| 478 | ```json |
Template literal with variable interpolation in command context
| 615 | ```json |
Template literal with variable interpolation in command context
| 630 | **Use `${CLAUDE_PLUGIN_ROOT}`** to reference scripts—expands to hook installation directory. |
Access to /etc/passwd
| 281 | - `"../../../etc/passwd"` (traversal attempts) |
Path traversal to sensitive directory
| 281 | - `"../../../etc/passwd"` (traversal attempts) |
Access to hidden dotfiles in home directory
| 263 | LOG_FILE=~/.claude-hooks/my-hook.log |
Access to hidden dotfiles in home directory
| 838 | echo "Hook running..." >> ~/.claude-hooks/debug.log |
Access to SSH directory
| 182 | ".ssh/*" |
Access to .env file
| 176 | ".env" |
Access to .env file
| 177 | ".env.*" |
Access to .env file
| 398 | ".env" |
Access to .env file
| 399 | ".env.*" |
Access to .env file
| 552 | test_case "Sensitive .env file" \ |
Access to .env file
| 553 | '{"input":{"file_path":".env"}}' \ |
Access to .env file
| 797 | [[ "$FILE" != *".env"* ]] || exit 2 |
Access to .env file
| 817 | if [[ $FILE == ".env" ]]; then |
Access to .env file
| 818 | echo "Don't edit .env" >&2 |
Access to .env file
| 823 | if [[ $FILE == ".env" ]]; then |
Access to .env file
| 824 | echo "Blocked: .env is protected" >&2 |
External URL reference
| 965 | - [Claude Code Hooks Docs](https://code.claude.com/docs/en/hooks) |
External URL reference
| 967 | - [PRPM Hook Packages](https://prpm.dev/packages?format=claude&subtype=hook) |
Install this skill with one command
/learn @pr-pm/claude-hook-writer