agentmods.dev

PreToolUse

PreToolUse is a hook for coding agents from yurukusa/cc-safe-setup. Its token cost is not measured, scanned C, original, MIT.

A set of checks that runs before Claude Code uses selected tools, such as shell commands that can delete files or alter Git history. It blocks risky recursive deletion and destructive Git operations unless they use the allowed safer form.

In plain words
What is it for?
Use it to guard shell commands, file-writing actions, and Git work during automated coding sessions, especially when the agent can execute commands without manual review.
Why use it?
It adds an automatic pause before commands that could remove project files, rewrite commits, or force unwanted changes.

Hook

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the cc-safe-setup plugin — 2 skills, 1 hook shipped together

not rated 6 +1 changed yesterday C scan tokens not measured original MIT
View the source file yurukusa/cc-safe-setup
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add yurukusa/cc-safe-setup
Claude Code
/plugin install cc-safe-setup

Or install cc-safe-setup, the plugin that ships this one along with the rest of its 2 skills, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for PreToolUse

README.md
[![agentmods](https://agentmods.dev/badge/hooks/yurukusa/cc-safe-setup/pre-tool-use.svg)](https://agentmods.dev/hooks/yurukusa/cc-safe-setup/pre-tool-use)
Your own site
<a href="https://agentmods.dev/hooks/yurukusa/cc-safe-setup/pre-tool-use"><img src="https://agentmods.dev/badge/hooks/yurukusa/cc-safe-setup/pre-tool-use.svg" alt="Measured on agentmods" height="20"></a>
Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade C, and why

PreToolUse scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the commands this hook runs, not an audit. A hook is shell that executes on your machine at the event it names, which is why every command in it is printed with what was found.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

"command": "INPUT=$(cat); FILE=$(printf %s \"$INPUT\" | jq -r '.tool_input.file_path // empty'); [ -z \"$FILE\" ] && exit 0; BASE=$(basename \"$FILE\"); if echo \"$BASE\" | grep -qE '^\\.env\\.(example|sample|template)$'
hooks/hooks.json · 58 lines

How it starts

The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.

{
  "PreToolUse": [
    {
      "matcher": "Bash",
      "hooks": [
        {
          "type": "command",
          "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | jq -r '.tool_input.command // empty'); [ -z \"$CMD\" ] && exit 0; STMTS=$(printf '%s\\n' \"$CMD\" | awk '{ if (sub(/\\\\[ \\t]*$/, \" \")) { b = b $0; next } print b $0; b = \"\" } END { if (b != \"\") print b }' | tr ';&|' '\\n' | sed -E 's/#.*$//'); HIT=$(printf '%s\\n' \"$STMTS\" | grep -E '^[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]+([^[:space:]]+[[:space:]]+)*(-[a-zA-Z]*[rR]|--recursive)' | grep -vE '(^|[[:space:]/])(node_modules|dist|build|__pycache__|tmp)(/|[[:space:]]|$)'); if [ -n \"$HIT\" ]; then echo 'BLOCKED: recursive rm on non-safe target. Use specific paths.' >&2; exit 2; fi"
        }
      ]
    },
    {
      "matcher": "Bash",
      "hooks": [
        {
          "type": "command",
          "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | jq -r '.tool_input.command // empty'); [ -z \"$CMD\" ] && exit 0; CHECK=$(printf '%s\\n' \"$CMD\" | awk '{ if (sub(/\\\\[ \\t]*$/, \" \")) { b = b $0; next } print b $0; b = \"\" } END { if (b != \"\") print b }' | sed -E 's/--force-with-lease(=[^[:space:]]*)?//g'); if printf '%s\\n' \"$CHECK\" | grep -qE 'git[[:space:]]+push[[:space:]]+.*--force|git[[:space:]]+reset[[:space:]]+--hard|git[[:space:]]+clean[[:space:]]+-[a-zA-Z]*[fd]'; then echo 'BLOCKED: destructive git operation. Confirm before proceeding.' >&2; exit 2; fi"
        }
      ]
    },
    {
      "matcher": "Bash",
      "hooks": [
        {
          "type": "command",
          "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | jq -r '.tool_input.command // empty'); [ -z \"$CMD\" ] && exit 0; CHECK=$(printf '%s\\n' \"$CMD\" | awk '{ if (sub(/\\\\[ \\t]*$/, \" \")) { b = b $0; next } print b $0; b = \"\" } END { if (b != \"\") print b }'); if printf '%s\\n' \"$CHECK\" | grep -qiE '(api[._-]?key|secret|password|token).*=.*[A-Za-z0-9]{20}'; then echo 'BLOCKED: potential

Read the full file on GitHub · 58 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed bac332ea7dba
  2. 5d ago First seen · 58 lines scan C 23f4e3be3300

Subscribe to this mod's changes

PreToolUse is a hook published in the GitHub repository yurukusa/cc-safe-setup (6 stars, last pushed yesterday), licensed MIT. Its token cost is not measured: a hook is shell that never enters the context. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflowSecurityclaude-codeclaude-code-hooksclideveloper-toolshookssafety
Related

Other hooks, from other repositories

PermissionDenied

Runs on the PermissionDenied event, executing dev-hook.mjs with --hook. From FailproofAI/failproofai.

FailproofAI/failproofai · not measured

ConfigChange

Runs on the ConfigChange event, executing dev-hook.mjs with --hook. From FailproofAI/failproofai.

FailproofAI/failproofai · not measured

ElicitationResult

Runs on the ElicitationResult event, executing dev-hook.mjs with --hook. From FailproofAI/failproofai.

FailproofAI/failproofai · not measured

PreToolUse

Runs before the agent uses a tool for Read, Edit, Write, Read, Grep, Task and Edit tool calls, executing pre-tool-use-broadcast.mjs, path-rules.mjs, tldr-read-enforcer.mjs, smart-search-router.mjs, tldr-context-inject.mjs, arch-context-inject.mjs, file-claims.mjs, edit-context-inject.mjs and signature-helper.mjs via…

parcadei/Continuous-Claude-v3 · not measured

Stop

Runs when the agent finishes a response, executing hook_launcher.py, stop_hook.sh and compiler-in-the-loop-stop.mjs via uv (3 commands). From parcadei/Continuous-Claude-v3.

parcadei/Continuous-Claude-v3 · not measured

SessionStart

Runs when a session starts, executing cli.js via node. From code-yeongyu/codex-rules.

code-yeongyu/codex-rules · not measured