Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hwells4/create-hooks/create-hooknpx skills add hwells4/create-hooks --skill create-hookgit clone --depth 1 https://github.com/hwells4/create-hooksWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.02411 |
| Opus 5 | $0.00019 | $0.01205 |
| Sonnet 5 | $0.00008 | $0.00482 |
| Haiku 4.5 | $0.00004 | $0.00241 |
Grade B, and why
create-hook scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
| **View hook logs** | debugging.md | Run `scripts/hook-log.py` or `tail -f .claude/hooks/.debug.log` | How it starts
The opening of the file, as written. The whole thing — 183 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Core principle: prefer dispatchers over standalone hooks. When multiple hooks exist on the same event, they should be consolidated into a single dispatcher with a checks/ directory. This eliminates redundant JSON parsing, prevents conflicts, and makes adding new checks trivial (drop a file). The create-hook flow automatically detects when a dispatcher should be used and routes accordingly.
If bare /create-hook with no arguments, ask:
What do you need?
- Create a new hook - I'll check your existing hooks first. If you already have a dispatcher or multiple hooks on the same event, I'll add a check to the dispatcher instead of creating a standalone hook.
- Edit an existing hook - Modify a hook or dispatcher check in .claude/hooks/
- Consolidate hooks - Migrate multiple standalone hooks into a single dispatcher
- Debug a hook - Something's not working? Let's figure out why
- View hook logs - See which hooks are firing (
scripts/hook-log.py) - Validate hooks - Check that hooks are correctly configured and ready for use
- Analyze hooks - See what hooks you have running and find gaps
- Something else - Templates, settings, MCP tools, security, env vars
When creating a new hook, ALWAYS ask about installation level:
Where should this hook be installed?
- Project level (
.claude/settings.json) - Runs only in THIS project, checked into git - User level (
~/.claude/settings.json) - Runs in ALL your projects - Local only (
.claude/settings.local.json) - Project-level but gitignored (for personal/sensitive hooks)
| Intent | References to Load | Workflow |
|---|---|---|
| Create new hook | hook-events.md, json-output.md, security.md, sub-agents.md, dispatcher-pattern.md | Spawn inventory agent → dispatcher decision → create (check or standalone) → tester agent |
| Create prompt-based hook | prompt-based-hooks.md, hook-events.md | Determine event → configure prompt → test |
| Create component-scoped hook | component-scoped-hooks.md, hook-events.md | Define in frontmatter → test |
| Edit existing hook | hook-events.md, json-output.md, debugging.md | Read existing hook → modify → test |
| Debug hook | debugging.md, hook-events.md | Diagnose → fix → test |
| Validate hooks | debugging.md | Run scripts/validate-hook.py --project |
| View hook logs | debugging.md | Run scripts/hook-log.py or tail -f .claude/hooks/.debug.log |
| Analyze hooks | sub-agents.md | Spawn inventory agent |
| Consolidate hooks (dispatcher) | dispatcher-pattern.md, hook-events.md | workflows/create-dispatcher.md |
| MCP tools | mcp-tools.md, hook-events.md | Show patterns |
| SessionStart/env vars | session-env-vars.md, hook-events.md | Show patterns |
| Security review | security.md | Show checklist |
| Templates | (load template file directly) | Show template |
| Add to settings | workflows/add-to-settings.md | Configure |
<essential_principles>
- Analyze first - Before creating, understand existing hooks to prevent conflicts
- Dispatcher by default - After inventory, check if a dispatcher exists or should be created:
- Dispatcher exists for this event → Add a check script to
checks/, not a standalone hook - 2+ hooks already exist on this event → Recommend consolidating into a dispatcher first
- 0-1 hooks exist → Create standalone hook (but keep it dispatcher-ready)
See
references/dispatcher-pattern.mdfor the full pattern.
- Dispatcher exists for this event → Add a check script to
- Ask installation level - ALWAYS ask user: project, user, or local level
- Project (
.claude/settings.json) - This project only, version controlled - User (
~/.claude/settings.json) - ALL projects for this user - Local (
.claude/settings.local.json) - This project only, gitignored
- Project (
- Debug wrapper by default - Always include
debug-wrap.shand wrap commands with it (user can opt out) - Input via stdin - Hooks receive JSON with session_id, tool_name, tool_input, etc.
- Output via exit codes - 0=success, 2=blocking error (stderr shown to Claude)
- Parallel execution - All matching hooks run simultaneously (60s timeout default)
- Validate after creation - Run
scripts/validate-hook.pyto confirm proper installation </essential_principles>
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/component-scoped-hooks.md 5.4 KB
- references/debugging.md 8.7 KB
- references/dispatcher-pattern.md 15 KB
- references/hook-events.md 5.0 KB
- references/json-output.md 4.8 KB
- references/mcp-tools.md 4.1 KB
- references/prompt-based-hooks.md 6.1 KB
- references/security.md 5.0 KB
- references/session-env-vars.md 7.6 KB
- references/sub-agents.md 9.8 KB
- scripts/hook-log.py 5.2 KB runs code
- scripts/validate-hook.py 27 KB runs code
- templates/auto-approve.py 2.8 KB runs code
- templates/bash-validator.sh 1.1 KB runs code
- templates/context-injection.py 3.3 KB runs code
- templates/debug-wrap.sh 755 B runs code
- templates/dispatcher.py 3.3 KB runs code
- templates/dispatcher.sh 2.1 KB runs code
- templates/intelligent-stop-prompt.json 1.3 KB
- templates/notification-forwarder.sh 1.5 KB runs code
- templates/permission-handler.py 3.8 KB runs code
- templates/python-validator.py 2.3 KB runs code
- templates/stop-gate.py 3.7 KB runs code
- workflows/add-to-settings.md 4.0 KB
- workflows/create-dispatcher.md 7.6 KB
- workflows/create-hook.md 4.8 KB
- workflows/validate-hooks.md 3.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 183 lines · 39 tokens per session scan B 1c120369441e
create-hook is a skill published in the GitHub repository hwells4/create-hooks (21 stars, last pushed 2mo ago), licensed MIT. It adds 39 tokens to every session and 2,411 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
delegacion-local
Regla y catálogo para delegar pasos mecánicos (resumir, clasificar, extraer, boilerplate, mensaje de commit desde un diff, traducir texto o archivo, resumir salida de lint/tests/CI, explicar código, describir una imagen, verificar si el backend local está disponible) a modelos locales vía las tools local del MCP…
anti-slop
Use when reviewing your own tool-call sequence (or another agent's) for wasteful patterns — re-reading a file you just edited, repeated reads of the same path, bash echo for plain communication. Surfaces concrete patterns to avoid, not vague style advice.
hooks-automation
Use when you need to implement or debug Claude Code hooks using the 3-phase memory sync pattern (STATUS→PROGRESS→COMPLETE) with JSON flow-control responses.
hook-factory
Generate production-ready Claude Code hooks with interactive Q&A, automated installation, and enhanced validation. Supports 10 templates across 7 event types for comprehensive workflow automation.
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
golden-rss
Use when testing the rss golden build.