Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add litestar-org/litestar-skills/plugin install litestarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/hooks/litestar-org/litestar-skills/session-start)<a href="https://agentmods.dev/hooks/litestar-org/litestar-skills/session-start"><img src="https://agentmods.dev/badge/hooks/litestar-org/litestar-skills/session-start.svg" alt="Measured on agentmods" height="20"></a>Grade B, and why
SessionStart scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the commands this hook runs, not an audit. A hook is shell that executes on your machine at the event it names, which is why every command in it is printed with what was found.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
"command": "r=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; if [ -n \"$r\" ] && [ ! -f \"${r%/}/hooks/session-start.sh\" ]; then r=\"\"; fi; if [ -z \"$r\" ] && [ -d \"$HOME/.claude/plugins/marketplaces\" ]; then r=\"$(fi What it actually says
{
"SessionStart": [
{
"matcher": "startup|clear|compact",
"hooks": [
{
"name": "litestar-session-start",
"type": "command",
"command": "r=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; if [ -n \"$r\" ] && [ ! -f \"${r%/}/hooks/session-start.sh\" ]; then r=\"\"; fi; if [ -z \"$r\" ] && [ -d \"$HOME/.claude/plugins/marketplaces\" ]; then r=\"$(find -L \"$HOME/.claude/plugins/marketplaces\" -path \"*/litestar/hooks/session-start.sh\" -type f -print 2>/dev/null | sed 's#/hooks/session-start.sh$##' | head -n 1)\"; fi; if [ -z \"$r\" ] && [ -f ./hooks/session-start.sh ]; then r=\".\"; fi; [ -n \"$r\" ] || exit 0; CLAUDE_PLUGIN_ROOT=\"${r%/}\" bash \"${r%/}/hooks/session-start.sh\"",
"description": "Inject project-aware Litestar skill reminders into the session context.",
"async": false
}
]
}
]
}What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 16 lines scan B 0475c9ec5d05
SessionStart is a hook published in the GitHub repository litestar-org/litestar-skills (14 stars, last pushed 17d ago), licensed MIT. Its token cost is not measured: a hook is shell that never enters the context. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other hooks, from other repositories
SessionEnd
Runs when a session ends, executing capture-session-tail.sh. From Paretofilm/superpowers-gstack.
Stop
Runs when the agent finishes a response, executing session-stop.sh via bash. From IdoCohen560/claude-unity-game-studio.
PostToolUse
Runs after a tool call finishes, executing run_hook.py via python3 (2 commands). From sbhooley/ainl-cortex.
TaskCompleted
Runs when a task is marked completed, executing task-completed.sh. From ben-alkov/the_swarm.
SessionStart
Runs when a session starts, executing run_hook.py via python3. From sbhooley/ainl-cortex.
PostToolUse
Runs after a tool call finishes for Edit and Write tool calls, executing run-hook.cmd. From omas-odoo/odoo-superpowers.