The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The scripts/test-hook.sh utility executes local shell scripts provided as arguments. While this involves dynamic execution (bash -c), it is the primary intended function of the script (a test runner for developer-authored hooks) and does not involve remote code or untrusted inputs.
[DATA_EXFILTRATION] (SAFE): The examples/load-context.sh script reads local file metadata (existence of package.json, Cargo.toml, etc.) to determine project type and exports environment variables to the project's environment file. This is a standard and documented use of Claude Code SessionStart hooks.
[PROMPT_INJECTION] (SAFE): The skill documentation (references/migration.md and references/patterns.md) contains natural language prompts intended for use in 'prompt-type' hooks. These prompts are specifically designed to increase security by instructing the LLM to detect and block destructive operations or credential exposure.
[BEST_PRACTICES] (SAFE): The scripts/hook-linter.sh and scripts/validate-hook-schema.sh scripts enforce security best practices, such as variable quoting (to prevent shell injection), path validation, and timeout constraints.

hook-development