anthropics/claude-code hook skill
code generation
Claude Code is a terminal-based AI agent that reads your codebase and helps you write code faster through natural language commands. It can execute routine coding tasks, explain complex code, manage git workflows, and integrates with your IDE or GitHub via @claude mentions.
Run routine coding tasks and workflows using plain language commands in your terminal Get explanations of complex code sections in your existing codebase Execute git operations and handle version control workflows through natural language Extend functionality with custom commands using the available plugin system Tag @claude on GitHub issues and pull requests for integrated assistance 2 CRITICAL✓ 7 HIGH✓ 33 MEDIUM 9 LOW 1 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 3 confirmed (33%) 6 likely real (67%) 9 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 5 high-signal, 6 mostly false-positive (hidden by default)
CHK-083 4 findings 4 likely
0% FP CHK-008 2 findings 2 likely
0% FP CHK-001 1 finding 1 confirmed
0% FP CHK-089 1 finding 1 confirmed
0% FP CHK-125 1 finding 1 confirmed
0% FP ▼ Show 6 checkers that are mostly false positives (9 findings) 52 findings click to expand
CHK-001 Wildcard PreToolUse hook — fires before EVERY tool call
plugins/hookify/hooks/hooks.json
AI: confirmed likely ▼
CHK-089 --dangerously-skip-permissions in executable — all permission checks bypassed
plugins/security-guidance/hooks/llm.py
AI: confirmed confirmed ▼
CHK-083 Potential path traversal — user-controlled path in file operation: plugins/security-guidance/hooks/_base.py
plugins/security-guidance/hooks/_base.py
AI: likely real possible ▼
CHK-008 Stop governance hook captures broad tool output
plugins/ralph-wiggum/hooks/hooks.json
AI: likely real likely ▼
CHK-008 PostToolUse governance hook captures broad tool output
plugins/hookify/hooks/hooks.json
AI: likely real likely ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/patterns.py
plugins/security-guidance/hooks/patterns.py
AI: confirmed likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: plugins/security-guidance/hooks/llm.py
plugins/security-guidance/hooks/llm.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: plugins/security-guidance/hooks/session_state.py
plugins/security-guidance/hooks/session_state.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: plugins/security-guidance/hooks/security_reminder_hook.py
plugins/security-guidance/hooks/security_reminder_hook.py
AI: likely real likely ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/ensure_agent_sdk.py
plugins/security-guidance/hooks/ensure_agent_sdk.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in agents/conversation-analyzer.md
plugins/hookify/agents/conversation-analyzer.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in commands/help.md
plugins/hookify/commands/help.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in commands/help.md
plugins/hookify/commands/help.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in writing-rules/SKILL.md
plugins/hookify/skills/writing-rules/SKILL.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in writing-rules/SKILL.md
plugins/hookify/skills/writing-rules/SKILL.md
possible ▼
CHK-115 Credential file path referenced in skill content: .env"
plugins/plugin-dev/skills/hook-development/SKILL.md
possible ▼
CHK-115 Credential file path referenced in skill content: .env,
plugins/plugin-dev/skills/hook-development/references/migration.md
possible ▼
CHK-115 Credential file path referenced in skill content: .env
plugins/plugin-dev/skills/hook-development/references/patterns.md
possible ▼
CHK-115 Credential file path referenced in skill content: .env`
plugins/plugin-dev/skills/mcp-integration/references/authentication.md
possible ▼
CHK-022 Trigger expansion pattern — proactive trigger
plugins/plugin-dev/skills/agent-development/examples/agent-creation-prompt.md
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in plugins/security-guidance/hooks/patterns.py [build-script context]
plugins/security-guidance/hooks/patterns.py
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in plugins/security-guidance/hooks/llm.py [build-script context]
plugins/security-guidance/hooks/llm.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
plugins/security-guidance/hooks/llm.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in .devcontainer/Dockerfile
.devcontainer/Dockerfile
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in .devcontainer/devcontainer.json
.devcontainer/devcontainer.json
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in hookify/README.md
plugins/hookify/README.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in hookify/README.md
plugins/hookify/README.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in plugin-settings/SKILL.md
plugins/plugin-dev/skills/plugin-settings/SKILL.md
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in references/frontmatter-reference.md
plugins/plugin-dev/skills/command-development/references/frontmatter-reference.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in references/testing-strategies.md
plugins/plugin-dev/skills/command-development/references/testing-strategies.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in references/migration.md
plugins/plugin-dev/skills/hook-development/references/migration.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/security_reminder_hook.py
plugins/security-guidance/hooks/security_reminder_hook.py
possible ▼
CHK-125a os.unlink() — file deletion — no scope constraint in hooks/security_reminder_hook.py
plugins/security-guidance/hooks/security_reminder_hook.py
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in hooks/session_state.py
plugins/security-guidance/hooks/session_state.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/diffstate.py
plugins/security-guidance/hooks/diffstate.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/gitutil.py
plugins/security-guidance/hooks/gitutil.py
possible ▼
CHK-125a os.unlink() — file deletion — no scope constraint in hooks/gitutil.py
plugins/security-guidance/hooks/gitutil.py
possible ▼
CHK-022 Trigger expansion pattern — proactive trigger
plugins/plugin-dev/skills/agent-development/references/triggering-examples.md
possible ▼
CHK-022 Trigger expansion pattern — proactive trigger
plugins/plugin-dev/skills/agent-development/references/agent-creation-system-prompt.md
possible ▼
CHK-073 Curl Pipe Bash Install detected in README.md [test context]
README.md
possible ▼
CHK-022 Trigger expansion pattern — proactive trigger
plugins/plugin-dev/skills/agent-development/examples/complete-agent-examples.md
possible ▼
CHK-115 Credential file path referenced in skill content: .env$
plugins/hookify/skills/writing-rules/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in security-guidance/README.md
plugins/security-guidance/README.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://docs.example.com/plugins/my-plugin
plugins/plugin-dev/skills/plugin-structure/references/manifest-reference.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://mcp.asana.com/sse
plugins/plugin-dev/skills/mcp-integration/references/server-types.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in hooks/security_reminder_hook.py
plugins/security-guidance/hooks/security_reminder_hook.py
possible ▼
CHK-025 Hardcoded endpoint in skill: https://mcp.asana.com/sse
plugins/plugin-dev/skills/mcp-integration/references/authentication.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://api.production.com/mcp
plugins/plugin-dev/skills/mcp-integration/references/server-types.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://api.example.com/mcp
plugins/plugin-dev/skills/mcp-integration/examples/http-server.json
possible ▼
CHK-025 Hardcoded endpoint in skill: https://mcp.asana.com/sse
plugins/plugin-dev/skills/mcp-integration/examples/sse-server.json
possible ▼
CHK-025 Hardcoded endpoint in skill: https://mcp.example.com/sse
plugins/plugin-dev/skills/mcp-integration/examples/sse-server.json
possible ▼
CHK-062 Hook output is trusted as user input by Claude Code (confirmed in system prompt)
plugins/learning-output-style/hooks/hooks.json
possible ▼
▼ Show 9 false positives (15% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.