This skill should be used when the user asks to create a hookify rule, write a hook rule, configure hookify, add a hookify rule, or needs guidance on hookify rule syntax and patterns.

Writing Hookify Rules Overview ECC evaluates project local Hookify rules with its built in Node runtime. No separate Hookify plugin or Python installation is required when ECC hooks are enabled. Hookify rules are markdown files with YAML frontmatter that define patterns to watch for and messages to show when those patterns match. Rules are stored in .claude/hookify.{rule name}.local.md files. Rule File Format Basic Structure Frontmatter Fields Field Required Values Description name Yes kebab case string Unique identifier (verb first: warn , block , require ) enabled Yes true/false Toggle without deleting event Yes bash/file/stop/prompt/all Which hook event triggers this action No warn/block warn (default) shows message; block prevents operation pattern Yes regex string Pattern to match ( or use conditions for complex rules) Advanced Format (Multiple Conditions) Condition fields by event: bash: command file: file path , new text , old text , content prompt: user prompt Operators: regex match , contains , equals , not contains , starts with , ends with All conditions must match for rule to trigger. Event Type Guide bash Events Match Bash command patterns: Dangerous commands: rm\s+ rf , dd\s+if= , mkfs Privilege escalation: sudo\s+ , su\s+ Permission issues: chmod\s+777 file Events Match Edit/Write/MultiEdit operations: Debug code: console\.log\( , debugger Security risks: eval\( , innerHTML\s = Sensitive files: \.env$ , credentials , \.pem$ stop Events Completion checks and reminders. Pattern . matches always. prompt Events Match user prompt content for workflow enforcement. Pattern Writing Tips Regex Basics Escape special chars: . to \. , ( to \( \s whitespace, \d digit, \w word char + one or more, zero or more, ? optional OR operator Common Pitfalls Too broad : log matches "login", "dialog" — use console\.log\( Too specific : rm rf /tmp — use rm\s+ rf YAML escaping : Use unquoted patterns; quoted strings need \\s Testing Avoid nested quantifiers such as (a+)+ . The runtime rejects patterns with common catastrophic backtracking shapes because rules run synchronously in the hook path, and every regex evaluation has a 25 ms hard timeout. Invalid, symlinked, or oversized local rules fail open and emit a diagnostic without disabling other Hookify rules. Git tracked local rules are disabled by default. Set ECC HOOKIFY ALLOW TRACKED=1 only after reviewing those files; ordinary gitignored rules created locally remain active without that override. Runtime Behavior warn injects the message as event specific additional context and does not block. block denies matching Bash, PowerShell, Write, Edit, or MultiEdit calls before execution. On prompt, post tool, and stop events, block uses Claude Code's structured block decision. Stop rules skip recursive stop hook active events to prevent infinite continuation loops. File Organization Location : .claude/ directory in project root Naming : .claude/hookify.{descriptive name}.local.md Gitignore : Add .claude/ .local.md to .gitignore Commands /hookify [description] Create new rules (auto analyzes conversation if no args) /hookify list View all rules in table format /hookify configure Toggle rules on/off interactively /hookify help Full documentation Quick Reference Minimum viable rule:

hookify-rules