writing-hookify-rules

writing-hookify-rules is a skill for Claude Code, Codex from thevibeworks/claude-code-docs. It costs 52 tokens per session (2,255 once invoked), scanned D, a copy of writing-hookify-rules, MIT.

A guide for writing hookify rule files using simple Markdown files with settings and matching patterns.

In plain words
What is it for?
Use it to define rules that warn, block, or check behaviour during command execution, file editing, user prompts, or agent stopping.
Why use it?
It removes the need to edit a central hooks configuration file when you want to watch for a specific command, file change, prompt, or stopping action.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the hookify plugin — 1 skill, 4 commands, 1 agent shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/thevibeworks/claude-code-docs/writing-rules
Any agent
npx skills add thevibeworks/claude-code-docs --skill writing-rules
Clone the repo
git clone --depth 1 https://github.com/thevibeworks/claude-code-docs

Made for: Claude Code, Codex.

Or install hookify, the plugin that ships this one along with the rest of its 1 skill, 4 commands, 1 agent.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for writing-hookify-rules

README.md
[![agentmods](https://agentmods.dev/badge/skills/thevibeworks/claude-code-docs/writing-rules.svg)](https://agentmods.dev/skills/thevibeworks/claude-code-docs/writing-rules)
Your own site
<a href="https://agentmods.dev/skills/thevibeworks/claude-code-docs/writing-rules"><img src="https://agentmods.dev/badge/skills/thevibeworks/claude-code-docs/writing-rules.svg" alt="Measured on agentmods" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,255 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 2 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.02255
Opus 5 $0.00026 $0.01128
Sonnet 5 $0.00010 $0.00451
Haiku 4.5 $0.00005 $0.00226

Measured 2d ago against content hash 2994b5d31522, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade D, and why

writing-hookify-rules scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

chmod\s+777 Matches: chmod 777, chmod 777

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm\s+-rf Matches: rm -rf, rm -rf
Origin

This is a copy

100% identical to writing-hookify-rules — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

content/github/claude-plugins-official/plugins/hookify/skills/writing-rules/SKILL.md · 375 lines

How it starts

The opening of the file, as written. The whole thing — 375 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Writing Hookify Rules

Overview

Hookify rules are markdown files with YAML frontmatter that define patterns to watch for and messages to show when those patterns match. Rules are stored in .claude/hookify.{rule-name}.local.md files.

Rule File Format

Basic Structure

---
name: rule-identifier
enabled: true
event: bash|file|stop|prompt|all
pattern: regex-pattern-here
---

Message to show Claude when this rule triggers.
Can include markdown formatting, warnings, suggestions, etc.

Frontmatter Fields

name (required): Unique identifier for the rule

  • Use kebab-case: warn-dangerous-rm, block-console-log
  • Be descriptive and action-oriented
  • Start with verb: warn, prevent, block, require, check

enabled (required): Boolean to activate/deactivate

  • true: Rule is active
  • false: Rule is disabled (won't trigger)
  • Can toggle without deleting rule

event (required): Which hook event to trigger on

  • bash: Bash tool commands
  • file: Edit, Write, MultiEdit tools
  • stop: When agent wants to stop
  • prompt: When user submits a prompt
  • all: All events

action (optional): What to do when rule matches

  • warn: Show message but allow operation (default)
  • block: Prevent operation (PreToolUse) or stop session (Stop events)
  • If omitted, defaults to warn

pattern (simple format): Regex pattern to match

  • Used for simple single-condition rules
  • Matches against command (bash) or new_text (file)
  • Python regex syntax

Example:

event: bash
pattern: rm\s+-rf

Advanced Format (Multiple Conditions)

For complex rules with multiple conditions:

---
name: warn-env-file-edits
enabled: true
event: file
conditions:
  - field: file_path
    operator: regex_match
    pattern: \.env$
  - field: new_text
    operator: contains
    pattern: API_KEY
---

You're adding an API key to a .env file. Ensure this file is in .gitignore!

Condition fields:

  • field: Which field to check
    • For bash: command
    • For file: file_path, new_text, old_text, content
  • operator: How to match
    • regex_match: Regex pattern matching
    • contains: Substring check
    • equals: Exact match
    • not_contains: Substring must NOT be present
    • starts_with: Prefix check
    • ends_with: Suffix check
  • pattern: Pattern or string to match

Read the full file on GitHub · 375 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 375 lines · 52 tokens per session scan D 2994b5d31522

Subscribe to this mod's changes

writing-hookify-rules is a skill published in the GitHub repository thevibeworks/claude-code-docs (39 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 2,255 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). It is 100% identical to writing-hookify-rules, differing in 0 lines, and is treated as a copy.