nsheaps/claude-code
plugins/agentic-behavior/skills/claude-code/SKILL.md
Reference material for Claude Code internals — the on-disk layout under ~/.claude and project-scope .claude, the plugin cache, session-env propagation, and the full hook lifecycle. Auto-recall when working on Claude-Code-related tasks: writing or debugging hooks, authoring plugins, inspecting session state, troubleshooting why an env var is or isn't visible to a Bash tool call, or when paths under ~/.claude or ~/.claude/plugins/ come up.
$ install --global
skillsauthnpx skillsauth add nsheaps/ai-mktpl claude-codeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 29, 2026, 4:59 AM308.1s3 files scanned
SKILL.md
- name:
- claude-code
- description:
- >-
- Claude-Code-related tasks:
- writing or debugging hooks, authoring plugins,
- argument-hint:
- [topic]
- user-invocable:
- false
<!-- TODO: This skill will be moved to a future "claude-code" plugin in ai-mktpl that absorbs the upstream claude-plugins-official/plugin-dev and skill-dev plugins. -->
Claude Code Internals
Reference material for how Claude Code (the CLI harness) is laid out on disk and how its hook system works. This is auto-recalled when an agent needs to reason about Claude Code internals; the body here is intentionally short so it doesn't bloat context. Read the supplementary docs in this directory for detail when the task warrants it.
When to read which doc
| Task | Doc |
| -------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| "Where does Claude store sessions / projects / plugins?" | folder-structure.md |
| "What's in ~/.claude/session-env/<id>/ and is it a leak?" | folder-structure.md (session-env section) |
| "How is project path encoded under ~/.claude/projects/?" | folder-structure.md |
| "What hook events exist? When does X fire?" | hooks.md |
| "What JSON does a PreToolUse hook receive / return?" | hooks.md |
| "Difference between command, prompt, agent, http, mcp_tool hook types" | hooks.md |
| "How do SessionStart hooks propagate env to Bash calls?" | hooks.md (CLAUDE_ENV_FILE section) |
Quick orientation
- User-scope state:
~/.claude/(shared across projects on this machine) - Project-scope state:
<repo>/.claude/(committed to the repo, project-specific) - Plugin cache:
~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/ - Hooks are configured in
settings.jsonunder a top-levelhookskey, or bundled inside a plugin at<plugin>/hooks/hooks.json.
Related skills and plugins
plugin-dev:plugin-structure— authoring plugin manifests and layoutplugin-dev:hook-development— writing hooks (events, output contracts)plugin-dev:skill-development— authoring skills like this oneupdate-config— modifyingsettings.json/settings.local.json
Source of truth
When this skill and the official docs disagree, the official docs win: https://code.claude.com/docs/en/hooks. File a follow-up to update this skill if you find a discrepancy.
Related Skills
nsheaps/github-app-session-env
tools
VerifiedTrustedCommunity
Manually reproduce what the github-app plugin's SessionStart hook does to make a GitHub App installation token usable in the current session — materialize the PEM, generate the token, isolate GH_CONFIG_DIR, write the runtime env file, and wire CLAUDE_ENV_FILE so every Bash call sees GH_TOKEN/GITHUB_TOKEN. Use when the hook did not run, the token is missing from the environment, or a shell/teammate needs the token wired up by hand. <example>GH_TOKEN isn't set even though github-app is configured</example> <example>the github-app SessionStart hook didn't run, set up the token manually</example> <example>wire the github app token into CLAUDE_ENV_FILE</example> <example>gh keeps falling back to the wrong account, isolate GH_CONFIG_DIR</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/github-app-git-identity
tools
VerifiedTrustedCommunity
Manually configure the GitHub App bot git identity the way the github-app plugin's SessionStart hook does — resolve the app slug and bot user ID, build the <slug>[bot] name and noreply email, set GIT_AUTHOR_*/GIT_COMMITTER_* env vars, and write an isolated GIT_CONFIG_GLOBAL with the gh auth git-credential helper. Use when commits are attributed to the wrong account, "Author identity unknown" appears, or git identity must be set up by hand. <example>my commits are showing up as the handler, not the bot</example> <example>git says Author identity unknown after the github-app hook ran</example> <example>configure the github app bot git identity manually</example> <example>set up the gh credential helper for git push</example>
3SKILL.mdUpdated Jun 9, 2026
nsheaps/spec-management
tools
VerifiedTrustedCommunity
Manages spec files for requirements capture and validation
3SKILL.mdUpdated Jun 7, 2026
nsheaps/plugins/bash-command-rejection/skills/bash-chaining-alternatives
tools
VerifiedTrustedCommunity
# Bash Chaining Alternatives This skill teaches you how to work around the bash command chaining restriction enforced by this plugin. ## Why Chaining is Blocked The `bash-command-rejection` plugin blocks these operators: | Operator | Name | Why Blocked | | -------- | ---------- | ----------------------------------------------------------------------------------- | | `&&` | AND chain | Runs cmd2 only if cmd1 su
3SKILL.mdUpdated Jun 7, 2026