Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/pluto2060/CTXWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/hooks/pluto2060/ctx/setup)<a href="https://agentmods.dev/hooks/pluto2060/ctx/setup"><img src="https://agentmods.dev/badge/hooks/pluto2060/ctx/setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/hooks/pluto2060/ctx/setup"><img src="https://agentmods.dev/badge/hooks/pluto2060/ctx/setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
Setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the commands this hook runs, not an audit. A hook is shell that executes on your machine at the event it names, which is why every command in it is printed with what was found.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
"command": "bash -c 'set -e; VD=$HOME/.local/share/claude-vault; mkdir -p $VD; PY=python3; if $PY -m venv $VD/venv 2>/dev/null || true; then VPY=$VD/venv/bin/python; $VPY -m ensurepip --upgrade 2>/dev/null || curl -sS ht What it actually says
{
"Setup": [
{
"matcher": "*",
"hooks": [
{
"type": "command",
"command": "bash -c 'set -e; VD=$HOME/.local/share/claude-vault; mkdir -p $VD; PY=python3; if $PY -m venv $VD/venv 2>/dev/null || true; then VPY=$VD/venv/bin/python; $VPY -m ensurepip --upgrade 2>/dev/null || curl -sS https://bootstrap.pypa.io/get-pip.py | $VPY 2>/dev/null || true; $VPY -m pip install --quiet ctx-retriever rank_bm25 numpy sqlite-vec 2>/dev/null; $VPY -m pip install --quiet sentence-transformers 2>/dev/null || true; $VPY -m ctx_retriever.cli.install 2>/dev/null; echo \"[CTX] setup complete (venv=$VD/venv)\"; fi'",
"timeout": 180
}
]
}
]
}What else hooks.json configures
This page is one entry in a file that holds 5. Installing the file brings all of them; each is measured and scanned on its own page.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 14 lines scan A 1124e84bba16
Setup is a hook published in the GitHub repository pluto2060/CTX (9 stars, last pushed 4mo ago), licensed MIT. Its token cost is not measured: a hook is shell that never enters the context. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other hooks, from other repositories
SessionStart
Runs when a session starts on startup, resume and clear, running npx tdd-guard@latest. From nizos/tdd-guard.
SessionStart
Runs when a session starts, running an inline shell check. From teranos/ground.
PreToolUse
Runs before the agent uses a tool, running an inline shell check. From teranos/ground.
PostToolUse
Runs after a tool call finishes for Bash and Skill tool calls, running claude-memes hook bash (2 commands). From ShovalBenjer/claude-memes-skills.
Stop
Runs when the agent finishes a response, running claude-memes hook stop. From ShovalBenjer/claude-memes-skills.
UserPromptSubmit
Runs when you submit a prompt, before the agent sees it, executing user-prompt-submit.sh via bash. From viktorinkov/shook.