hook-authoring

Secure hook authoring involves validating inputs, sanitizing secrets, and preventing injection attacks across PreToolUse, PostToolUse, and UserPromptSubmit events. This Skill provides security patterns, validation frameworks, and testing guidance for JSON and Python SDK hooks to block dangerous inputs before code execution.

You can intercept PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop, and PreCompact events to validate tool calls, log outputs, inject context, enforce workflows, and apply security policies at plugin, project, and global scopes.

Hook validation requires structured testing of JSON and Python SDK hooks against input validation, anti-injection, and secret sanitization requirements while respecting performance budgets. This Skill covers validation patterns, asynchronous I/O handling, and testing guidance for production-safe hooks.

Yes. Hooks enable context injection, tool validation, and workflow automation across hook events. You can enforce security policies at multiple scopes—plugin, project, and global—to standardize behavior and block risky operations before execution.

Secret sanitization is a core hook pattern covered here. Scrub sensitive data from logs and context using validation rules before passing data downstream, preventing accidental exposure in tool outputs and subagent communication.

No. This Skill provides a complete guide with quick-start examples of JSON hooks and Python SDK patterns that block dangerous inputs, making it accessible to developers new to hook authoring who want security-first design.