claude-code-hooks_skill

Overview

This skill adds pre- and post-execution hook support for Claude Code tool invocations so you can validate, approve, or log tool usage. It defines events like PreToolUse, PostToolUse, PermissionRequest and lets you run custom shell scripts or commands tied to matchers. Use it to enforce safety, implement audit trails, and integrate external approvals before tools run.

How this skill works

Configure hooks in your Claude settings file to trigger commands when events fire. Each hook entry includes a matcher (which selects tools by name or pattern), a command to run, and a timeout. Hook scripts receive a JSON payload on stdin describing the event (for example tool_name and tool_input) and must return specific exit codes to continue, block, or signal errors. PostToolUse hooks can capture execution output for auditing.

When to use it

• Block dangerous or sensitive tool invocations before they run
• Record tool usage and outputs for audit and compliance
• Send approval requests or notifications (e.g., Slack) before permissioned actions
• Validate tool inputs and file paths to prevent path traversal or injection
• Run cleanup or aggregation tasks after tools complete

Best practices

• Quote all shell variables and validate paths; avoid unsanitized user input
• Scope hooks with matchers (e.g., "Bash" or mcp__*) instead of using a global wildcard
• Set reasonable timeouts to avoid blocking agent progress
• Use $CLAUDE_PROJECT_DIR for project-relative paths and avoid .. traversal
• Return documented exit codes (0 continue, 2 block with error) and handle jq errors

Example use cases

• PreToolUse validator that inspects a Bash command and blocks if it contains rm -rf
• PostToolUse auditor that appends tool_name, timestamp, and output to a secure log
• PermissionRequest hook that posts a message to Slack and waits for human approval
• SessionStart hook that loads project-specific context files into the agent's environment
• PreToolUse script that normalizes and validates file paths against a whitelist