Hooks run deterministic code at lifecycle points; skills and commands package reusable instructions; plugins bundle agents, skills, hooks, and MCP servers; memory/configuration supplies durable guidance. Use each for its intended scope. They improve reuse and control, but untrusted bundles and prompt files are supply-chain inputs—not authorization or sandbox boundaries.
You will decide which extension surface fits a requirement, add a pre-tool policy hook conceptually, and review a plugin as executable capability.
Do not put a deterministic security decision only in a skill prompt.
Hooks match lifecycle events such as pre-tool use and execute callbacks. A pre-tool hook can normalize input, attach context, block a forbidden path, or require additional policy evidence. Keep it fast, deterministic, observable, and free of recursive agent calls.
Conceptual configuration:
Hook input/output types evolve; use the current reference for exact callback signatures and decision fields.
Load only intended project/user setting sources. Review skills and plugins before enabling them, pin versions/paths, restrict their tools, and include their content hashes in run metadata. A repository-controlled instruction file can be modified by contributors; treat it as code requiring review.
Test event matching, allow/block outcomes, timeouts, hook exceptions, subagent propagation, plugin version changes, and conflicting instructions. Confirm a failed hook defaults to the safer state for consequential tools.
Failure injection: Install a plugin whose skill requests a broad MCP tool. The tool gateway must still enforce policy; packaged instructions cannot grant themselves authority.
Build an extension manifest listing source, version/hash, granted tools, hooks, network needs, owner, and review date. Make deployment fail when an unreviewed capability appears.