Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add athola/claude-night-market --skill writing-rulesgit clone --depth 1 https://github.com/athola/claude-night-marketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/claude-night-market/writing-rules)<a href="https://agentmods.dev/skills/athola/claude-night-market/writing-rules"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/writing-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/athola/claude-night-market/writing-rules"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/writing-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.01636 |
| Opus 5 | $0.00015 | $0.00818 |
| Sonnet 5 | $0.00006 | $0.00327 |
| Haiku 4.5 | $0.00003 | $0.00164 |
Grade D, and why
writing-rules scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod\s+777 → chmod 777 Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm\s+-rf → rm -rf How it starts
The opening of the file, as written. The whole thing — 288 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Table of Contents
- Overview
- Quick Start
- Rule File Format
- Frontmatter Fields
- Event Types
- Advanced Conditions
- Operators
- Field Reference
- Pattern Writing
- Regex Basics
- Examples
- Test Patterns
- Example Rules
- Block Destructive Commands
- Warn About Debug Code
- Require Tests
- Protect Production Files
- Management
- Related Skills
- Best Practices
Hookify Rule Writing Guide
When To Use
- Creating behavioral rules to prevent unwanted actions
- Defining persistent guardrails for Claude Code sessions
When NOT To Use
- Complex multi-step workflows - use agents instead
- One-time operations that do not need persistent behavioral rules
Overview
Hookify rules are markdown files with YAML frontmatter that define patterns to watch for and messages to show when those patterns match. Rules are stored in .claude/hookify.{rule-name}.local.md files.
Quick Start
Create .claude/hookify.dangerous-rm.local.md:
---
name: dangerous-rm
enabled: true
event: bash
pattern: rm\s+-rf
action: block
---
🛑 **Dangerous rm command detected!**
This command could delete important files.
Verification: Run the command with --help flag to verify availability.
The rule activates immediately - no restart needed!
Rule File Format
Frontmatter Fields
name (required): Unique identifier (kebab-case)
enabled (required): true or false
event (required): bash, file, stop, prompt, or all
action (optional): warn (default) or block
pattern (simple): Regex pattern to match
Event Types
- bash: Bash tool commands
- file: Edit, Write, MultiEdit tools
- stop: When agent wants to stop
- prompt: User prompt submission
- all: All events
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 288 lines · 29 tokens per session scan D e48d6776b52f
writing-rules is a skill published in the GitHub repository athola/claude-night-market (337 stars, last pushed yesterday), licensed MIT. It adds 29 tokens to every session and 1,636 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
regex-mastery
Use this skill when writing regular expressions, debugging pattern matching,optimizing regex performance, or implementing text validation. Triggers on regex, regular expressions, pattern matching, lookahead, lookbehind, named groups, capture groups, backreferences, and any task requiring text pattern matching.
attack-patterns-reference
Use when classifying a verified web or WordPress behavior and selecting a related validation skill.
effect-http-api
Build typed HTTP APIs with Effect's HttpApi — endpoints with schemas, handlers, security middleware, OpenAPI docs, derived clients, and handler unit tests. Use when building HTTP servers, REST APIs, or typed HTTP clients with Effect v4.
effect-rpc-cluster
Build typed RPC endpoints and cluster-distributed entities, singletons, cron jobs, and durable workflows with Effect's RPC and Cluster modules (Rpc/RpcGroup/RpcServer/RpcClient, Entity/Sharding/Singleton, Node/Bun bundles). Use when building RPC services or distributed/clustered Effect systems.
effect-error-handling
Implement typed error handling in Effect v4 using Schema.TaggedErrorClass, catchTag/catchTags, catchReason/catchReasons, Cause, ErrorReporter, and recovery patterns. Use this skill when working with Effect error channels, handling expected failures, or designing error recovery strategies.
effect-http-server
Build HTTP servers with effect/unstable/http — HttpRouter routes and middleware, HttpServerRequest schema decoding, HttpServerResponse constructors, multipart uploads, websocket upgrades, static files, NodeHttpServer/BunHttpServer layers, and in-memory web handlers. Use when serving raw HTTP routes, reading request…