Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cfircoo/claude-code-toolkit/create-hooksnpx skills add cfircoo/claude-code-toolkit --skill create-hooksgit clone --depth 1 https://github.com/cfircoo/claude-code-toolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.01682 |
| Opus 5 | $0.00038 | $0.00841 |
| Sonnet 5 | $0.00015 | $0.00336 |
| Haiku 4.5 | $0.00008 | $0.00168 |
Grade D, and why
manage-hooks scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- User-global: `~/.claude/settings.json` Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
| 1, "create", "add", "build", "set up" | "create a hook", "add a PreToolUse hook", "block rm -rf" | workflows/create-hook.md | How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<essential_principles> Hooks are event-driven automation for Claude Code that execute shell commands, LLM prompts, or multi-turn agents in response to tool usage, session events, and user interactions. They provide deterministic control over Claude's behavior without modifying core code.
1. Three Hook Types:
- command — shell command, deterministic, fast. Exit 0 = proceed, exit 2 = block. JSON stdout for structured control.
- prompt — single-turn LLM evaluation (Haiku default). Returns
{"ok": true}or{"ok": false, "reason": "..."}. - agent — multi-turn subagent with tool access (up to 50 turns). Same ok/reason output. Use when verification needs codebase access.
2. Event → Matcher → Hook — Events (PreToolUse, Stop, etc.) trigger matchers (regex on tool name/context) which fire hooks. See <quick_reference> for the full event table.
3. Configuration Locations (highest priority first):
- User-global:
~/.claude/settings.json - Project shared:
.claude/settings.json - Project local:
.claude/settings.local.json - Or use
/hooksinteractive menu in Claude Code
4. Environment Variables:
| Variable | Value |
|---|---|
$CLAUDE_PROJECT_DIR |
Project root directory |
${CLAUDE_PLUGIN_ROOT} |
Plugin directory (plugin hooks only) |
$ARGUMENTS |
Hook input JSON (prompt/agent hooks only) |
$CLAUDE_ENV_FILE |
Path for persisting environment variables |
5. Safety Essentials:
- Stop hook loops: Always check
stop_hook_activefield in Stop/SubagentStop hooks — exit 0 if true - Timeouts: Set reasonable values in seconds (default: 10 min commands, 60s agents, 30s prompts)
- Permissions:
chmod +xon script files - Path safety: Quote
"$CLAUDE_PROJECT_DIR"for spaces - Shell profiles: Wrap echo in
~/.zshrc/~/.bashrcwith[[ $- == *i* ]]checks — non-interactive shells can corrupt JSON output - PermissionRequest: Doesn't fire in headless mode (
-p); use PreToolUse instead </essential_principles>
- Create a new hook
- Debug / fix a hook
- Create a toolkit hook (distributable)
- Get guidance on hook design
If $ARGUMENTS provides clear intent, skip the menu and route directly.
Intent-based routing (when $ARGUMENTS provides clear intent):
- "block dangerous commands" → workflows/create-hook.md
- "my hook isn't triggering" → workflows/debug-hook.md
- "package for toolkit" → workflows/create-toolkit-hook.md
- "what event should I use" → workflows/get-guidance.md
After reading the workflow, follow it exactly.
<quick_reference>
| Event | When it fires | Can block? | Matcher filters |
|---|---|---|---|
| PreToolUse | Before tool execution | Yes | tool name |
| PostToolUse | After tool succeeds | Yes (decision: "block") |
tool name |
| PostToolUseFailure | After tool fails | No | tool name |
| PermissionRequest | Permission dialog appears | Yes | tool name |
| UserPromptSubmit | User submits a prompt | Yes | no matcher support |
| Stop | Claude finishes responding | Yes | no matcher support |
| SubagentStart | Subagent is spawned | No | agent type |
| SubagentStop | Subagent finishes | Yes | agent type |
| SessionStart | Session begins/resumes | No | source (startup, resume, clear, compact) |
| SessionEnd | Session terminates | No | reason (clear, logout, etc.) |
| PreCompact | Before context compaction | No | trigger (manual, auto) |
| Notification | Claude needs attention | No | type (permission_prompt, idle_prompt, etc.) |
| TeammateIdle | Agent about to go idle | Yes (exit 2) | no matcher support |
| TaskCompleted | Task marked complete | Yes (exit 2) | no matcher support |
| ConfigChange | Config file changes | Yes (decision: "block") |
config type |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 130 lines · 0 tokens per session scan D c0547826bab2
manage-hooks is a skill published in the GitHub repository cfircoo/claude-code-toolkit (17 stars, last pushed 5mo ago), licensed MIT. It adds 76 tokens to every session and 1,682 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mcporter
List, auth, and call MCP servers/tools from the terminal.
agent-messaging
Send and receive cryptographically signed messages between AI agents using the Agent Messaging Protocol (AMP). Use when the user asks to "send a message to an agent", "check agent inbox", "message another agent", "reply to a message", "notify an agent", or any inter-agent communication task.
📝 任务完成后归档
重要提醒: 每次完成复杂调试或开发任务后,主动执行此流程! 将学到的经验归档为 skill,供以后参考。不要等用户提醒。.
oracle
Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).
agent-mode
Unified tool for managing agent LLM modes (add, remove, update, list, switch).
agento11y-prod-setup
Sets up production evaluation and guardrails for a DEPLOYED AI agent in Grafana Agent Observability, grounded in the agent's own code and its real ingested traffic. The judgment layer on top of the agento11y skill: it reads the agent's source (system prompt, tools, entrypoint) AND samples its live traffic via gcx…