Install
$ agentstack add skill-poorgramer-zack-copilot-cli-things-hookify-help Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged2 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Dangerous shell/eval execution.
- high Destructive filesystem operation.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ● Dynamic code execution Used
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Hookify Plugin Help
Present the hookify plugin to the user: architecture, rule format, available skills, and getting started steps.
Overview
Hookify creates custom hooks that prevent unwanted behaviors via simple markdown configuration files instead of editing hooks.json.
How It Works
1. Hook System
Hookify installs generic hooks that run on these events:
- preToolUse: Before any tool executes (powershell, edit, create, etc.)
- postToolUse: After a tool executes
- agentStop: When Copilot wants to stop working
- userPromptSubmitted: When user submits a prompt
These hooks read configuration files from .github/hookify.*.local.md and check if any rules match the current operation.
2. Configuration Files
Users create rules in .github/hookify.{rule-name}.local.md files:
---
name: warn-dangerous-rm
enabled: true
event: bash
pattern: rm\s+-rf
---
⚠️ **Dangerous rm command detected!**
This command could delete important files. Please verify the path.
Key fields:
name: Unique identifier for the ruleenabled: true/false to activate/deactivateevent: bash, file, stop, prompt, or allpattern: Regex pattern to match
The message body is what Copilot sees when the rule triggers.
3. Creating Rules
Option A: Use hookify-create skill
hookify-create Don't use console.log in production files
This analyzes your request and creates the appropriate rule file.
Option B: Create manually Create .github/hookify.my-rule.local.md with the format above.
Option C: Analyze conversation
hookify-create
Without arguments, hookify analyzes recent conversation to find behaviors you want to prevent.
Available Skills
hookify-create- Create hooks from conversation analysis or explicit instructionshookify-help- Show this help (what you're reading now)hookify-list- List all configured hookshookify-configure- Enable/disable existing hooks interactively
Example Use Cases
Prevent dangerous commands:
---
name: block-chmod-777
enabled: true
event: bash
pattern: chmod\s+777
---
Don't use chmod 777 - it's a security risk. Use specific permissions instead.
Warn about debugging code:
---
name: warn-console-log
enabled: true
event: file
pattern: console\.log\(
---
Console.log detected. Remember to remove debug logging before committing.
Require tests before stopping:
---
name: require-tests
enabled: true
event: stop
pattern: .*
---
Did you run tests before finishing? Make sure `npm test` or equivalent was executed.
Pattern Syntax
Use Python regex syntax:
\s- whitespace\.- literal dot|- OR+- one or more*- zero or more\d- digit[abc]- character class
Examples:
rm\s+-rf- matches "rm -rf"console\.log\(- matches "console.log("(eval|exec)\(- matches "eval(" or "exec("\.env$- matches files ending in .env
Important Notes
No Restart Needed: Hookify rules (.local.md files) take effect immediately on the next tool use. The hookify hooks are already loaded and read your rules dynamically.
Block or Warn: Rules can either block operations (prevent execution) or warn (show message but allow). Set action: block or action: warn in the rule's frontmatter.
Rule Files: Keep rules in .github/hookify.*.local.md - they should be git-ignored (add to .gitignore if needed).
Disable Rules: Set enabled: false in frontmatter or delete the file.
Troubleshooting
Hook not triggering:
- Check rule file is in
.github/directory - Verify
enabled: truein frontmatter - Confirm pattern is valid regex
- Test pattern:
python3 -c "import re; print(re.search('your_pattern', 'test_text'))" - Rules take effect immediately - no restart needed
Import errors:
- Check Python 3 is available:
python3 --version - Verify hookify plugin is installed correctly
Pattern not matching:
- Test regex separately
- Check for escaping issues (use unquoted patterns in YAML)
- Try simpler pattern first, then refine
Getting Started
- Create your first rule:
`` hookify-create Warn me when I try to use rm -rf ``
- Try to trigger it:
- Ask Copilot to run
rm -rf /tmp/test - You should see the warning
- Refine the rule by editing
.github/hookify.warn-rm.local.md
- Create more rules as you encounter unwanted behaviors
For more examples, check the examples/ directory.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Poorgramer-Zack
- Source: Poorgramer-Zack/copilot-cli-things
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.