creating-claude-hooks
Guides users in creating and publishing Claude Code hooks, detailing format, event types, and execution requirements.
Install this skill
Security score
The creating-claude-hooks skill was audited on May 12, 2026 and we found 20 security issues across 2 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 100 | ```json |
Template literal with variable interpolation in command context
| 351 | ```json |
Template literal with variable interpolation in command context
| 368 | ```json |
Template literal with variable interpolation in command context
| 400 | ```json |
Template literal with variable interpolation in command context
| 451 | | Absolute paths missing | Can't find scripts | Use `${CLAUDE_PLUGIN_ROOT}` | |
Template literal with variable interpolation in command context
| 492 | ```bash |
Piping content to bash shell
| 331 | | Bash | `command` | |
Access to hidden dotfiles in home directory
| 24 | - Configure in `.claude/settings.json`, `~/.claude/settings.json`, or plugin's `hooks.json` |
Access to hidden dotfiles in home directory
| 65 | Configure hooks in `.claude/settings.json` (project) or `~/.claude/settings.json` (global): |
Access to hidden dotfiles in home directory
| 280 | ~/.claude/hooks/PreToolUse |
Access to hidden dotfiles in home directory
| 281 | ~/.claude/hooks/Stop |
Access to hidden dotfiles in home directory
| 517 | LOG_FILE=~/.claude-hooks/debug.log |
Access to hidden dotfiles in home directory
| 573 | - Logs session start time to `~/.claude/session.log` |
Access to hidden dotfiles in home directory
| 580 | - write access to `~/.claude/` |
Access to hidden dotfiles in home directory
| 586 | echo "Session started at $(date)" >> ~/.claude/session.log |
Access to .env file
| 169 | *.env|*.pem|*.key) |
Access to .env file
| 189 | // Block .env files |
Access to .env file
| 190 | if (filePath.endsWith('.env')) { |
Access to .env file
| 191 | console.error('Blocked: Cannot modify .env files'); |
Access to .env file
| 493 | BLOCKED=(".env" ".env.*" "*.pem" "*.key") |