Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Hookify rule catalog that can guide users to install local project rules, with no hidden code execution or data access found.
Install this only when you intend to manage Hookify rules for a project. Review any rule content before placing it under .claude/, confirm the exact target path, and remember that installed rules may affect later agent sessions in that project.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
2. Follow naming convention: `kebab-case.md`
3. Include detailed message with alternatives
4. Test thoroughly before submitting
5. Update this SKILL.md catalog table
## Related
Using 'install' as a trigger risks colliding with a generic built-in or user intent around software/package installation, causing the wrong skill to activate. Because this skill includes instructions to copy rule files and alter .claude/ configuration, such shadowing increases the chance of unintended configuration changes from an ambiguous request.
The manifest includes broad triggers like 'install', 'rules', and 'templates', which are common user terms and can cause this skill to activate in contexts unrelated to Hookify. Unintended activation can lead the agent to suggest or perform configuration changes when the user did not explicitly request this skill, increasing the chance of accidental file modification or workflow interference.
The skill instructs Claude to read a rule file and write it into the user's .claude/ directory, which changes local agent/project configuration, but it does not prominently warn that this is a persistent modification. In an agent setting, silent or underexplained config writes are risky because users may not realize they are enabling new automated enforcement behavior in future sessions.
No suspicious patterns detected.