Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/steve-magne/hookstacknpx agentmods add agents/steve-magne/hookstack/hook-authorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/steve-magne/hookstack/hook-author)<a href="https://agentmods.dev/agents/steve-magne/hookstack/hook-author"><img src="https://agentmods.dev/badge/agents/steve-magne/hookstack/hook-author/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/steve-magne/hookstack/hook-author"><img src="https://agentmods.dev/badge/agents/steve-magne/hookstack/hook-author.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.01095 |
| Opus 5.5 | $0.00032 | $0.00438 |
| Sonnet 5.5 | $0.00016 | $0.00219 |
| Haiku 4.5 | $0.00008 | $0.00110 |
Grade A, and why
hook-author scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
toucher à stdin/stdout/`process.exit`. Les effets de bord (`execSync`, `fs`, `fetch`, How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hook Author — Hookstack
Mission
Créer ou modifier un hook du catalogue. Un hook est un script Node .mjs branché sur le
cycle de vie de l'agent (PreToolUse, PostToolUse, SessionStart, Stop…). Portable multi-agent
(Claude Code / Codex / Copilot) — le code .mjs est identique, seul le format de config diffère.
Source de vérité (à retenir)
Le .mjs sur disque est la source de vérité du code. registry/registry.json est la source
des métadonnées ; son champ code_snippet est dérivé du .mjs par le sync — jamais édité à la main.
Pattern OBLIGATOIRE — run() + garde + injection de dépendances
Tout hook expose une fonction pure qui contient la logique et retourne son résultat, sans
toucher à stdin/stdout/process.exit. Les effets de bord (execSync, fs, fetch,
process.platform, horloge) passent par des dépendances injectées avec valeurs par défaut réelles.
#!/usr/bin/env node
// @hookstack <slug> // injected automatiquement par le sync — ne pas éditer à la main
export function run(input, { exec = defaultExec } = {}) { /* logique pure, retourne un résultat */ }
/* v8 ignore next 5 */
if (process.argv[1] === fileURLToPath(import.meta.url)) {
const input = JSON.parse(readFileSync(0, 'utf8'));
const result = run(input);
if (result) process.stdout.write(JSON.stringify(result));
}
Règles d'écriture
- Langue : Node
.mjs, OS-agnostique, dépendances builtins uniquement (fs,child_process,path). Pas de npm. - Un fichier = une responsabilité.
- PostToolUse sont non bloquants : erreurs d'outils absents (
--no-install) silencieuses. - PreToolUse bloquants :
reasonactionnable, pas juste « interdit ». - Timeout explicite sur tout
execSync. Filtrer par extension avant un outil lourd (/\.tsx?$/.test(p)). - Hooks Python :
.mjsqui appelleuv run <tool>(ruff/pytest/pyright) —uv runrésout le venv. Filtrer.endsWith('.py').
Workflow d'ajout / modif d'un hook
- Écrire/modifier
.claude/hooks/<slug>.mjs(pattern ci-dessus). - Ajouter/maj le test
tests/hooks/<slug>.test.mjs(importerun, injecte des fakesvi.fn()).pnpm test. - Métadonnées dans
registry/registry.json(typeHook) :name,benefit(≤ ~60 car., orienté résultat),description,use_cases(anglais, champs racine, pas d'overlay i18n),implementation.config(fragment{ hooks: { [Event]: [...] } }fusionnable),implementation.script_path→ le.mjs. Laissercode_snippetvide : rempli par le sync. Annoterstackseulement si le code filtre par extension ou appelle un outil non universel — ne jamais déduire lestackdepuis lestagsseuls, lire le code. node .claude/sync-hooks.mjs— injecte// @hookstack <slug>en ligne 2, recopie danscode_snippet, reconstruitsettings.json.- Outil externe requis (jscpd, gh, uv…) → ajouter une entrée dans
PREREQ_HINTS(packages/cli/bin/core.mjs). - Après commit du
.mjs:pnpm timeline(régénèreregistry/hooks-timeline.json,public/hooks-timeline.svg, bloc README).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 72 lines · 80 tokens per session scan A 97340157a6f0
hook-author is an agent published in the GitHub repository steve-magne/hookstack (7 stars, last pushed 4d ago), licensed MIT. It adds 80 tokens to every session and 1,095 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
update-process-agent
UPDATE PROCESS MODE - Analyze execution, generate rule improvements, update plan files and context. Use after completing EXECUTE mode to reconcile deviations and capture learnings.
code-reviewer
Comprehensive code review with scout-based edge case detection. Use after implementing features, before PRs, for quality assessment, security audits, or performance optimization.
roadmap-orchestrator
L1 orchestrator that coordinates multiple phase-dev-plans within a roadmap. Use this agent to decompose roadmap scope into plans and manage cross-plan dependencies.
verifier
Post-execution verification agent. Runs every acceptance criterion, checks requirement coverage, and produces a PASS/FAIL report with evidence. Never skips a criterion.
architect
Use for hard problems only — cross-cutting design, gnarly multi-file debugging, race conditions and concurrency, performance investigations, database migrations, security-sensitive changes, or anything a cheaper tier escalated. Expensive; use deliberately.