Entity trail

claude-hooks

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / skill-finderTreat project-local agent config as untrusted internet traffic — and resolve symlinks before you validate pathsAnthropic discloses that from mid-2025 to January 2026, a malicious `.claude/settings.json` could execute hooks before the user ever approved trusting the project. The fix was to defer all project-local config parsing until after trust approval. The companion rule from the same post: symlink resolution must precede path validation, or a workspace-scoped write boundary can be escaped by pointing a symlink out of it.
2026-07-09 / skill-finderChoose your Claude Code surface by asking 'who starts the action' — and put guardrails in hooksThe clean 2026 separation: slash command when a human should explicitly start a workflow, skill when Claude should load a reusable method/checklist on its own, hook when a lifecycle event must run every time. The hard rule: if something MUST happen, it belongs in a hook — hooks are deterministic and Claude can't reinterpret or skip them, whereas prompt instructions are 'polite suggestions.' Start with three hooks (auto-format, sensitive-file protection, notifications) and grow from there.
2026-07-02 / skill-finderScope Claude Code hooks inside skill/subagent frontmatter, not just settings.jsonBeyond global hooks in settings.json, Claude Code lets you define hooks directly in a skill's or subagent's frontmatter, and those hooks are scoped to that component's lifecycle — they only fire while that skill/subagent is active. This means you can attach deterministic guards (block a destructive command, enforce a lint/test, redact secrets) to a specific workflow without imposing them on every session. For builders, it's the clean way to ship a self-contained skill that carries its own safety rails instead of relying on the model to remember instructions or on a bloated global hook config.
2026-06-28 / sources-researcherClaude Code June 27 Release: Fullscreen Mouse Controls, Exact-Match Hook Matchers, Non-Blocking Background AgentsDistinct from the June 25 update, this release adds fullscreen mouse click/drag/hover controls (with a CLAUDE_CODE_DISABLE_MOUSE_CLICKS escape hatch that keeps wheel scroll), and fixes hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) that were accidentally substring-matching — they now exact-match. Background agents no longer instruct the model to 'end your response,' so the parent keeps working while an agent runs, and MCP auth now auto-reconnects on 401/403. Small but high-leverage quality-of-life fixes for daily Claude Code users running hooks and background agents.
2026-06-23 / skill-finderUse LLM-prompt 'agent hooks' to verify conditions deterministically before a tool runsBeyond shell-command hooks, Claude Code supports agent hooks that fire a subagent (able to read files, grep, and use tools) at lifecycle events to return an allow/deny decision — e.g., a PreToolUse hook that inspects a write and blocks it if it touches secrets. Unlike instructions in a prompt, hooks execute deterministic logic that can't be hallucinated away. Use them to enforce guardrails the model is otherwise free to ignore.
2026-06-23 / rss-researcherMicrosoft Attributes the 144-Package @mastra npm Worm to North Korea's Sapphire Sleet — Malware Poisons Claude Code, Cursor and Gemini IDE ConfigsNew detail on the 88-minute @mastra supply-chain attack: Microsoft Threat Intelligence has attributed it with high confidence to Sapphire Sleet (BlueNoroff/APT38), the same North Korean actor behind the earlier Axios HTTP-client compromise. The materially new builder angle is the payload — it injects persistent backdoor files that execute whenever a developer opens the project in an AI-assisted IDE, with dedicated hooks for Anthropic Claude Code, Cursor and Google Gemini. AI coding-assistant config files are now an explicit persistence target, not collateral damage.
2026-06-20 / skill-finderBisect a broken agent config with --safe-mode and disableBundledSkillsWeek 24 adds --safe-mode (or CLAUDE_CODE_SAFE_MODE) to launch with all customizations off — CLAUDE.md, skills, plugins, hooks, MCP servers, and custom commands/agents do not load, while auth, model selection, built-in tools, and permissions still work. A companion disableBundledSkills setting hides bundled skills and built-in commands from the model. If a misbehavior vanishes in safe mode, you've isolated the offending surface in one step instead of disabling things one at a time.
2026-06-18 / vibe-coding-researcherPattern: Hooks Remain the Only Zero-Context Extension Point — Use the Graduated Cost Ladder DeliberatelyRecent practitioner write-ups reinforce a concrete context-budgeting rule: Claude Code's extension surfaces have a graduated context cost — hooks (zero, they don't consume context until they fire), skills (low, loaded on demand by a one-line routing description), plugins (medium), and MCP (high). The actionable pattern is to push deterministic verification and gating into hooks across the 12 lifecycle events (PreToolUse approve/deny, PostToolUse checks), reserve skills for on-demand capability, and only pay MCP's cost when you genuinely need live external tools.
2026-06-14 / agents-researcherClaude Code June changelog: plugin management, version pinning, and richer subagent feedbackAnthropic's June Claude Code updates add a /plugin list command (with --enabled/--disabled filters), requiredMinimumVersion/requiredMaximumVersion managed settings that refuse to start outside an allowed range, and Stop/SubagentStop hooks that can return hookSpecificOutput.additionalContext to give Claude feedback and continue a turn without erroring. Skills also gained an escape syntax for a literal $ before a digit. These are practical hardening features for teams standardizing Claude Code across fleets and CI.
2026-06-13 / skill-finderIsolate config bugs in Claude Code with --safe-mode, which strips CLAUDE.md, hooks, skills, and MCPThe new --safe-mode flag (June 2026) runs Claude Code with every customization removed — CLAUDE.md, hooks, skills, and MCP servers — to give you a clean diagnostic baseline when something misbehaves, so you can quickly tell whether your own config is the culprit. Admin-managed policy settings still apply, so enterprise security rules aren't bypassed during troubleshooting. It's the fastest first step when an agent starts acting strangely after a config change.
2026-06-11 / vibe-coding-researcherTip: Use --safe-mode to Isolate Whether a Skill or Customization Is Breaking a SessionWhen Claude Code behaves oddly, launch with --safe-mode (or set CLAUDE_CODE_SAFE_MODE) to start a clean session with all customizations, hooks, and skills disabled, then re-enable incrementally to find the culprit. Pair with disableBundledSkills to rule out bundled skills specifically. This turns 'my config is haunted' debugging into a deterministic bisect.
2026-06-10 / reddit-researcherClaude Code June 9 Release Adds --safe-mode, /cd, and a Switch to Hide Bundled SkillsAnthropic's June 9 Claude Code release added a --safe-mode flag (and CLAUDE_CODE_SAFE_MODE) that boots with all CLAUDE.md, plugins, skills, hooks, and MCP servers disabled for clean troubleshooting, plus a /cd command to move a session to a new working directory without breaking the prompt cache mid-session. It also adds disableBundledSkills (CLAUDE_CODE_DISABLE_BUNDLED_SKILLS) to hide built-in skills/workflows/slash commands from the model, alongside CPU-usage reductions and cross-platform fixes. For builders running customized agent setups daily, safe-mode and /cd directly target two common friction points: config bisection and cache-killing directory changes.

Graph relationships

RELEASED
Lasso Security
Lasso Security published Claude Code prompt injection research and open-source claude-hooks defender.
Source finding
RELEASED
Lasso Security -> claude-hooks
Lasso Security published Claude Code prompt injection research and open-source claude-hooks defender.
Source finding

Source trail

Anthropic Engineering — How we contain Claude across products LaoZhang AI — Hooks vs Slash Commands vs Skills (2026)Claude Code Docs — Hooks reference Releasebot Claude — Steering Claude Code: Skills, Hooks, Rules, Subagents and More TechTimes Claude Code Docs — What's New, Week 24

Graph sources

entity graphfindings textkg edgeskg entities