Hook Policy Builder
Turn agent behavior requirements into executable lifecycle hooks.
The skill scopes the target to .github/hooks/ and asks the user to clarify the event and whether behavior should block, warn, or inject context, providing some user involvement and scope control. It does not require explicit confirmation before writing, or disclose hook/script data flows, sensitive-data handling, external effects, isolation, permissions, or rollback, so points are deducted.
The workflow is internally coherent across requirement extraction, clarification, drafting, and iteration. However, it depends on the unavailable agent-customization/hooks.md and provides no verifiable template, JSON validation, script failure handling, or concrete key-path tests; under static calibration it cannot exceed 10, so points are deducted.
The name, purpose, and main scenarios are clear, including PreToolUse, SessionStart, and Stop events and block, warn, or context-injection behavior. Non-fit boundaries, input/output contracts, semantic trigger precision, Chinese support, and mainland-China network fit are not specified, so points are deducted.
Front matter, argument hint, path conventions, and staged guidance are readable. Repository README and LICENSE provide Microsoft attribution and MIT license evidence. Versioning, changelog, maintenance ownership, update path, complete installation/dependency notes, examples, and troubleshooting are missing, so points are deducted.
The skill can translate agent-behavior concerns into a hook draft and asks for a final summary and testing suggestions, so the core value is plausible. It supplies no ready-to-use template or representative verified output, and JSON/scripts may require substantial review; static calibration caps this at 7, so points are deducted.
The selected file is auditable, and the supplied repository material shows general tests and CI infrastructure. There are no tests, execution records, or third-party reproduction artifacts for this skill, and the key agent-customization material is absent, leaving only limited static traceability, so points are deducted.
- Obtain explicit confirmation of the final policy, trigger events, blocking conditions, and file-change scope before writing to .github/hooks/.
- Validate the JSON schema, command permissions, working directory, script inputs and outputs, and safe failure behavior against hooks.md; provide a recoverable rollback path.
- Do not pass secrets, user content, or unnecessary environment data into hooks; the supplied skill does not document these data flows or sensitive-data controls.
What does this skill do, and when should you use it?
This skill creates JSON hooks that enforce policy or automate agent lifecycle events. It first reviews the conversation to identify actions that should be blocked or gated, context that should be injected, and session or tool-use automation needs. When the policy is unclear, it asks about the event, the desired behavior, and any companion script. The resulting files are intended for .github/hooks/, followed by a summary of enforcement, testing ideas, and related customizations.
Reads the conversation history and extracts requirements such as prohibiting a command, requiring confirmation before an action, or injecting context at a particular point; asks for the hook event, block/warn/inject behavior, and companion-script needs when necessary; drafts and saves hook JSON and related scripts under .github/hooks/; identifies ambiguous or weak parts of the draft and asks follow-up questions; and, after finalization, summarizes the enforcement, suggests tests, and proposes related customizations.
- A developer wants to prevent an agent from running selected commands and uses the skill to draft a blocking or gating hook from the conversation.
- A team wants project context injected before the agent uses a tool and needs help defining the corresponding hook behavior.
- A user needs automation at session start or end and wants to specify events such as SessionStart or Stop.
- A user has a vague agent-governance requirement and needs clarification about the event, response type, or companion script before implementation.
What are this skill's strengths and limitations?
- Focused on producing hook JSON and companion scripts for .github/hooks/.
- Can derive agent-behavior constraints from the conversation instead of requiring a complete specification up front.
- Covers blocking, gating, warning, context injection, and session or tool-use automation needs.
- Defines working-directory and relative-path conventions and disallows environment variables for pathing outside plugin contexts.
- The SKILL.md does not include concrete hook JSON templates, event schemas, or script examples; it refers to hooks.md from the related agent-customization skill.
- Its frontmatter includes disable-model-invocation, so metadata or invocation handling may need adjustment in other clients.
- The source provides no standalone installation command, test suite, or verified platform list.
- When the conversation does not reveal a clear policy need, the user must supply the event, response behavior, and companion-script requirement.
How do you install this skill?
The skill is located at extensions/copilot/assets/prompts/skills/create-hook/SKILL.md in the microsoft/vscode repository. The README provides no separate installation command. To use the full skill collection, obtain the repository from https://github.com/microsoft/vscode and preserve this relative path. Client-specific installation or registration steps are not documented in the source.
How do you use this skill?
In an Agent Skills-compatible client, invoke “create-hook” and describe the behavior to enforce or automate, for example: “Do not run database deletion commands unless I confirm first.” The skill reviews the conversation first; if it cannot infer a clear policy, it asks about the triggering event, whether to block, warn, or inject context, and whether a companion script is needed. Generated content should be saved under .github/hooks/ in the workspace.