Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill hook-inventorygit clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-MonitorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/hook-inventory)<a href="https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/hook-inventory"><img src="https://agentmods.dev/badge/skills/hoangsonww/claude-code-agent-monitor/hook-inventory/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/hook-inventory"><img src="https://agentmods.dev/badge/skills/hoangsonww/claude-code-agent-monitor/hook-inventory.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 6 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.00808 |
| Opus 5 | $0.00036 | $0.00404 |
| Sonnet 5 | $0.00014 | $0.00162 |
| Haiku 4.5 | $0.00007 | $0.00081 |
Grade A, and why
hook-inventory scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
Explorer API — and flag hooks that POST to the network or run arbitrary commands. Reads /api/cc-config/hooks and /api/cc-config/hook-scripts. Use Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Network egress (P0)** — the command contains `curl`, `wget`, `http`, How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hook Inventory
Catalogue every Claude Code hook the user has configured and assess its safety —
read through the Agent Monitor dashboard at http://localhost:4820.
Input
The user provides: $ARGUMENTS
This may be:
- empty — inventory all hooks across every scope (default).
- an event name (
PreToolUse,PostToolUse,Stop,SubagentStop,SessionStart,SessionEnd,UserPromptSubmit,Notification,PreCompact) — restrict to that event. - "scripts" — focus on the
~/.claude/hookshandler scripts dir.
Data Sources
| Endpoint | Returns |
|---|---|
GET /api/cc-config/hooks |
{ items:[{ scope:"user"|"project"|"project-local", file, exists, hooks:{ <Event>:[{ matcher, type, command, timeout }] } }] } |
GET /api/cc-config/hook-scripts |
{ dir, items:[{ name, file, size, mtime }] } — the handler scripts under ~/.claude/hooks/ |
Report Sections
1. Configured hooks by scope
From /hooks, flatten each source into (scope, file, Event, matcher, type, command, timeout). Group by scope (user, project, project-local). Show the
event, matcher, hook type, and the raw command. Note which file each came
from so the user can edit the right one.
2. Hook scripts on disk
From /hook-scripts, list each file in ~/.claude/hooks/ with name, size
(KB), and mtime. Cross-reference: flag scripts referenced by a hook command
but missing from disk, and scripts on disk that no configured hook calls
(orphaned).
3. Safety flags
For every type: "command" entry escalate:
- Network egress (P0) — the command contains
curl,wget,http,https,nc, or pipes output off-box. Print the destination if visible. - Arbitrary execution (P1) — pipes to
sh/bash, evaluates downloaded content, or runs an unpinned interpreter on attacker-influenceable input. - No timeout (P2) — a
commandhook withtimeout: null; it can hang a session indefinitely. - Broad matcher (P3) —
matcher: "*"or empty on a destructive command.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 70 lines · 71 tokens per session scan A 236ff6256cfc
hook-inventory is a skill published in the GitHub repository hoangsonww/Claude-Code-Agent-Monitor (989 stars, last pushed 3d ago), licensed MIT. It adds 71 tokens to every session and 808 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-remediate
Apply selected review fixes; bare PR targets use current online items, while PR +review adds the latest matching artifact.
php-quality-tooling
Use when setting up PHPStan, Rector, or PHP-CS-Fixer on a non-Laravel PHP project, incl. CI wiring. Do NOT use for Laravel (Pint/Larastan), tests, or syntax.
breaking-changes
Use when checking whether a Claude Code update breaks our plugin ecosystem — hooks, agent frontmatter, manifest schema, or skill format.
radin-doctor
Check that radin's own install under /.claude is complete and its optional companion tools are reachable. Use for /radin-doctor, "check my radin install", "is radin installed correctly", "radin doctor", "verify radin install".
systematic-debugging
Guides root cause investigation before proposing fixes. Use when debugging, diagnosing failures, investigating test errors, or tracing unexpected behaviour.
qa-check
Auto-detects the project's tech stack, then audits for Accessibility, Performance, and Code Quality. Works across WordPress/PHP, Python, Node/JS, and static web projects.