agent-hooks
Agent skill from starchild-ai-agent/official-skills.
What it does
- "Stop me from running rm -rf / destructive bash" → pretoolcall block
- "Never let a private key get pushed to Telegram" → onoutboundmessage block
- "Log every tool call for audit" → posttoolcall observe
- "Remind the agent of X at the start of every model call" → prellmcall context
- "Don't let the agent claim it published when it didn't" → oncompletionclaim (in /goal) or onstop (in normal chat)
- "If the answer fails my quality check, make the agent redo it" → onstop block
- command MUST be the exact command: string from the shellhooks.yaml
Requirements & configuration
- by what you need to happen when something's wrong:
- prefer onstop when you need the user to actually see a corrected answer.
- | That message contains what looks like an API key, private key, or seed phrase. I won't process it — treat it as exposed and rotate it. | Blocked: message contains a credential. Rotate it. |
- When a hook needs real reasoning ("does this leak a secret?", "is this
- | onusermessage | block a pasted API key (incl. Bearer token), private key (PEM / EVM hex), seed phrase, Solana byte-array secret, or base58 WIF before the model sees it |
Configuration: POSTDESTRUCTIVESECRET_PATTERNSMSG_TOOLSFOOTER_STRIPCONFIGFOOTER_SHOW_TOKENSFOOTER_SHOW_CREDIT
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
Source
Repository: https://github.com/starchild-ai-agent/official-skills
agent-hooks FAQ
What does the agent-hooks skill do?
Manage shell hooks — user scripts that run at agent lifecycle points to block, rewrite, or warn on actions, via the /hooks command. "Stop me from running rm -rf / destructive bash" → pretoolcall block "Never let a private key get pushed to Telegram" → onoutboundmessage block
What does agent-hooks require?
by what you need to happen when something's wrong: prefer onstop when you need the user to actually see a corrected answer. | That message contains what looks like an API key, private key, or seed phrase. I won't process it — treat it as exposed and rotate it. | Blocked: message contains a credential. Rotate it. | When a hook needs real reasoning ("does this leak a secret?", "is this | onusermessage | block a pasted API key (incl. Bearer token), private key (PEM / EVM hex), seed phrase, Solana byte-array secret, or base58 WIF before the model sees it | Configuration keys: POST, DESTRUCTIVE, SECRET_PATTERNS, MSG_TOOLS, FOOTER_STRIP, CONFIG, FOOTER_SHOW_TOKENS, FOOTER_SHOW_CREDIT.
How do I install agent-hooks?
Run: npx -y skills add https://github.com/starchild-ai-agent/official-skills --skill agent-hooks --agent claude-code — the source lives at github.com/starchild-ai-agent/official-skills.
Maintain agent-hooks?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[agent-hooks on getagentictools](https://getagentictools.com/skills/starchild-ai-agent-official-skills-agent-hooks?ref=badge) npx agentictools info skills/starchild-ai-agent-official-skills-agent-hooks The second line is the CLI lookup for this page — handy in READMEs and docs.
