Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/griddynamics/rosetta/coding-agents-hooks-authoringnpx skills add griddynamics/rosetta --skill coding-agents-hooks-authoringgit clone --depth 1 https://github.com/griddynamics/rosettaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.01327 |
| Opus 5 | $0.00015 | $0.00664 |
| Sonnet 5 | $0.00006 | $0.00265 |
| Haiku 4.5 | $0.00003 | $0.00133 |
Grade A, and why
coding-agents-hooks-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<hooks_authoring>
Hook entry rule
Only files that export defineHook(…) AND call runAsCli(hook, module) belong directly in src/hooks/src/hooks/.
Every .ts at the top level of that directory becomes a standalone CJS bundle distributed to all 5 IDEs (claude, codex, copilot, cursor, windsurf).
Helper/data files without runAsCli belong in a named subdirectory: src/hooks/src/hooks/<feature>/.
Helper placement
- Feature-local helpers →
src/hooks/src/hooks/<feature>/(e.g.src/hooks/src/hooks/dangerous-actions/patterns.ts). - Cross-hook runtime helpers →
src/hooks/src/runtime/.
Build is non-recursive
src/hooks/scripts/build-bundles.mjs:24 uses readdirSync(hooksDir).filter(f => f.endsWith('.ts')).
There is no { recursive: true }. Subdirectories are invisible to the bundler.
Adding a top-level .ts without runAsCli produces a dead bundle for all 5 IDEs.
Adding a SemanticKind
When a hook needs a new tool category (e.g. mcp-call):
src/hooks/src/runtime/ide-registry.ts— add a row toTOOL_KINDSwith all 5 IDE columns (nullwhere the event doesn't exist).SemanticKind = keyof typeof TOOL_KINDSso TypeScript enforces coverage.src/hooks/src/runtime/ide-rows/<ide>.ts— if the kind requires special logic (e.g. prefix-match formcp__.*), add a conditional branch at the top oflookupToolKindin the IDE-row file before the table loop. Table-driven lookup alone cannot handle open-ended tool name patterns.- Hook entry — add the new kind to
def.on.toolKinds. - Matcher in
hooks.json.tmpl— widen to include new tool names/patterns.
Order matters: run-hook.ts:98 gates on toolKinds before calling run(ctx). Matcher passes the event in; toolKinds must include the mapped kind or the call is dropped silently.
Registration
Every new hook must appear in every plugin's hooks.json. The canonical source is plugins/core-claude/hooks/hooks.json.tmpl (and equivalent templates in other plugins). Direct edits to generated hooks.json files are overwritten on the next npx rosettify-plugins run.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 89 lines · 31 tokens per session scan A 8ba3d34dfc53
coding-agents-hooks-authoring is a skill published in the GitHub repository griddynamics/rosetta (341 stars, last pushed 4d ago), licensed Apache-2.0. It adds 31 tokens to every session and 1,327 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
authoring-skills-and-rules
Author Skills (SKILL.md) and rules/instructions across Claude Code, Cursor, OpenCode, Codex, and GitHub Copilot. Covers frontmatter, file layout, activation model, cross-platform mirroring, and the universal craft: progressive disclosure, trigger-rich descriptions (context pointers), leading words, token budget…
agents
Build voice AI agents with ElevenLabs. Use when creating voice assistants, customer service bots, interactive voice characters, or any real-time voice conversation experience.
memorix-orchestrate
Use when a main agent needs Memorix to coordinate explicit subagent work through tasks, handoffs, messages, file locks, or the orchestrate CLI.
skill-authoring
Creates and structures SKILL.md files for AI coding agents, including YAML frontmatter, trigger phrases, directive instructions, decision trees, code examples, and verification checklists. Use when the user asks to write a new skill, create a skill file, author agent capabilities, generate skill documentation, or…
implement
Canonical implementation parent command. Executes the active track task-by-task using TDD and verification gates, and routes to status, coverage, or revert when the user asks for progress, measurement, or rollback explicitly.
learn
Scan codebase to discover coding patterns and update draft/guardrails.md. Learns conventions (skip in future) and anti-patterns (always flag). Supports migration from workflow.md and pattern promotion.