$npx -y skills add anthropics/claude-code --skill writing-rulesThis skill should be used when the user asks to "create a hookify rule", "write a hook rule", "configure hookify", "add a hookify rule", or needs guidance on hookify rule syntax and patterns.
| 1 | # Writing Hookify Rules |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Hookify rules are markdown files with YAML frontmatter that define patterns to watch for and messages to show when those patterns match. Rules are stored in `.claude/hookify.{rule-name}.local.md` files. |
| 6 | |
| 7 | ## Rule File Format |
| 8 | |
| 9 | ### Basic Structure |
| 10 | |
| 11 | ```markdown |
| 12 | --- |
| 13 | name: rule-identifier |
| 14 | enabled: true |
| 15 | event: bash|file|stop|prompt|all |
| 16 | pattern: regex-pattern-here |
| 17 | --- |
| 18 | |
| 19 | Message to show Claude when this rule triggers. |
| 20 | Can include markdown formatting, warnings, suggestions, etc. |
| 21 | ``` |
| 22 | |
| 23 | ### Frontmatter Fields |
| 24 | |
| 25 | **name** (required): Unique identifier for the rule |
| 26 | - Use kebab-case: `warn-dangerous-rm`, `block-console-log` |
| 27 | - Be descriptive and action-oriented |
| 28 | - Start with verb: warn, prevent, block, require, check |
| 29 | |
| 30 | **enabled** (required): Boolean to activate/deactivate |
| 31 | - `true`: Rule is active |
| 32 | - `false`: Rule is disabled (won't trigger) |
| 33 | - Can toggle without deleting rule |
| 34 | |
| 35 | **event** (required): Which hook event to trigger on |
| 36 | - `bash`: Bash tool commands |
| 37 | - `file`: Edit, Write, MultiEdit tools |
| 38 | - `stop`: When agent wants to stop |
| 39 | - `prompt`: When user submits a prompt |
| 40 | - `all`: All events |
| 41 | |
| 42 | **action** (optional): What to do when rule matches |
| 43 | - `warn`: Show message but allow operation (default) |
| 44 | - `block`: Prevent operation (PreToolUse) or stop session (Stop events) |
| 45 | - If omitted, defaults to `warn` |
| 46 | |
| 47 | **pattern** (simple format): Regex pattern to match |
| 48 | - Used for simple single-condition rules |
| 49 | - Matches against command (bash) or new_text (file) |
| 50 | - Python regex syntax |
| 51 | |
| 52 | **Example:** |
| 53 | ```yaml |
| 54 | event: bash |
| 55 | pattern: rm\s+-rf |
| 56 | ``` |
| 57 | |
| 58 | ### Advanced Format (Multiple Conditions) |
| 59 | |
| 60 | For complex rules with multiple conditions: |
| 61 | |
| 62 | ```markdown |
| 63 | --- |
| 64 | name: warn-env-file-edits |
| 65 | enabled: true |
| 66 | event: file |
| 67 | conditions: |
| 68 | - field: file_path |
| 69 | operator: regex_match |
| 70 | pattern: \.env$ |
| 71 | - field: new_text |
| 72 | operator: contains |
| 73 | pattern: API_KEY |
| 74 | --- |
| 75 | |
| 76 | You're adding an API key to a .env file. Ensure this file is in .gitignore! |
| 77 | ``` |
| 78 | |
| 79 | **Condition fields:** |
| 80 | - `field`: Which field to check |
| 81 | - For bash: `command` |
| 82 | - For file: `file_path`, `new_text`, `old_text`, `content` |
| 83 | - `operator`: How to match |
| 84 | - `regex_match`: Regex pattern matching |
| 85 | - `contains`: Substring check |
| 86 | - `equals`: Exact match |
| 87 | - `not_contains`: Substring must NOT be present |
| 88 | - `starts_with`: Prefix check |
| 89 | - `ends_with`: Suffix check |
| 90 | - `pattern`: Pattern or string to match |
| 91 | |
| 92 | **All conditions must match for rule to trigger.** |
| 93 | |
| 94 | ## Message Body |
| 95 | |
| 96 | The markdown content after frontmatter is shown to Claude when the rule triggers. |
| 97 | |
| 98 | **Good messages:** |
| 99 | - Explain what was detected |
| 100 | - Explain why it's problematic |
| 101 | - Suggest alternatives or best practices |
| 102 | - Use formatting for clarity (bold, lists, etc.) |
| 103 | |
| 104 | **Example:** |
| 105 | ```markdown |
| 106 | ⚠️ **Console.log detected!** |
| 107 | |
| 108 | You're adding console.log to production code. |
| 109 | |
| 110 | **Why this matters:** |
| 111 | - Debug logs shouldn't ship to production |
| 112 | - Console.log can expose sensitive data |
| 113 | - Impacts browser performance |
| 114 | |
| 115 | **Alternatives:** |
| 116 | - Use a proper logging library |
| 117 | - Remove before committing |
| 118 | - Use conditional debug builds |
| 119 | ``` |
| 120 | |
| 121 | ## Event Type Guide |
| 122 | |
| 123 | ### bash Events |
| 124 | |
| 125 | Match Bash command patterns: |
| 126 | |
| 127 | ```markdown |
| 128 | --- |
| 129 | event: bash |
| 130 | pattern: sudo\s+|rm\s+-rf|chmod\s+777 |
| 131 | --- |
| 132 | |
| 133 | Dangerous command detected! |
| 134 | ``` |
| 135 | |
| 136 | **Common patterns:** |
| 137 | - Dangerous commands: `rm\s+-rf`, `dd\s+if=`, `mkfs` |
| 138 | - Privilege escalation: `sudo\s+`, `su\s+` |
| 139 | - Permission issues: `chmod\s+777`, `chown\s+root` |
| 140 | |
| 141 | ### file Events |
| 142 | |
| 143 | Match Edit/Write/MultiEdit operations: |
| 144 | |
| 145 | ```markdown |
| 146 | --- |
| 147 | event: file |
| 148 | pattern: console\.log\(|eval\(|innerHTML\s*= |
| 149 | --- |
| 150 | |
| 151 | Potentially problematic code pattern detected! |
| 152 | ``` |
| 153 | |
| 154 | **Match on different fields:** |
| 155 | ```markdown |
| 156 | --- |
| 157 | event: file |
| 158 | conditions: |
| 159 | - field: file_path |
| 160 | operator: regex_match |
| 161 | pattern: \.tsx?$ |
| 162 | - field: new_text |
| 163 | operator: regex_match |
| 164 | pattern: console\.log\( |
| 165 | --- |
| 166 | |
| 167 | Console.log in TypeScript file! |
| 168 | ``` |
| 169 | |
| 170 | **Common patterns:** |
| 171 | - Debug code: `console\.log\(`, `debugger`, `print\(` |
| 172 | - Security risks: `eval\(`, `innerHTML\s*=`, `dangerouslySetInnerHTML` |
| 173 | - Sensitive files: `\.env$`, `credentials`, `\.pem$` |
| 174 | - Generated files: `node_modules/`, `dist/`, `build/` |
| 175 | |
| 176 | ### stop Events |
| 177 | |
| 178 | Match when agent wants to stop (completion checks): |
| 179 | |
| 180 | ```markdown |
| 181 | --- |
| 182 | event: stop |
| 183 | pattern: .* |
| 184 | --- |
| 185 | |
| 186 | Before stopping, verify: |
| 187 | - [ ] Tests were run |
| 188 | - [ ] Build succeeded |
| 189 | - [ ] Documentation updated |
| 190 | ``` |
| 191 | |
| 192 | **Use for:** |
| 193 | - Reminders about required steps |
| 194 | - Completion checklists |
| 195 | - Process enforcement |
| 196 | |
| 197 | ### prompt Events |
| 198 | |
| 199 | Match user prompt content (advanced): |
| 200 | |
| 201 | ```markdown |
| 202 | --- |
| 203 | event: prompt |
| 204 | conditions: |
| 205 | - field: user_prompt |
| 206 | operator: contains |
| 207 | pattern: deploy to production |
| 208 | --- |
| 209 | |
| 210 | Production deployment checklist: |
| 211 | - [ ] Tests passing? |
| 212 | - [ ] Reviewed by team? |
| 213 | - [ ] Monitoring ready? |
| 214 | ``` |
| 215 | |
| 216 | ## Pattern Writing Tips |
| 217 | |
| 218 | ### Regex Basics |
| 219 | |
| 220 | **Literal characters:** Most cha |