Skills, hooks and MCP · Skills and hooks

The prompt line that should have been a hook

Find the defect in a team's fix for a force-push their agent made, and decide which of five prompt rules become hooks, and at which point in the loop.

critiqueeasyExercise · 3 min · 55 of 77

On this page

A coding agent force-pushed to main, and the team's fix was to make the rule louder. The fix is the defect.

The situation

A team's coding agent runs about 2,400 sessions a month. Its system prompt ends with five rules:

"Never force-push, and never push directly to main."
"Run the tests before you say you are done."
"Never print the contents of .env files or any API key."
"Prefer small, focused commits."
"Ask before deleting files outside the build directory."

Last month's traces show three force-pushes to main, each of which overwrote colleagues' commits and took about three hours to untangle; eleven sessions that ended "done" with tests failing; and one API key pasted into a pull-request comment. The rule that failed sat 1,800 tokens into a 6,000-token prompt, and the worst session was at turn 41 with 90,000 tokens of context.

The proposed fix moves rule 1 to the first line of the prompt, in capitals, followed by "THIS IS VERY IMPORTANT". Nothing else changes.

The question

Find the defect in the proposed fix, then decide for each of the five rules whether it stays a prompt line or becomes a hook, at which point in the loop, and what the hook checks.

A strong answer · Rubric · Where answers go wrong

Write your answer first, then open

A strong answer

The fix treats a guarantee as a wording problem. Three failures in 2,400 sessions is a rate of about 0.13%; capitals and position may lower it, nothing makes it zero, and each failure costs hours no rewording recovers. A rule whose failure cannot be undone belongs in code that runs before the effect.

Pushes: a pre-tool hook. Pushing goes through a git_push(branch, force) tool, the shell tool's allow-list excludes git push, and the hook denies a protected branch or force true. The floor is branch protection on the remote, which refuses a force-push to main whatever the agent runs.
Tests: a stop hook. When the model ends its turn, run the tests touching changed files; on failure, refuse the stop with the failing names, and after three refusals end the run with a tests_failing status the trace counts.
Secrets: pre-tool hooks that deny reads of .env and key files and reject a comment body containing a key-shaped string. Redacting results after the call keeps keys out of context, but only the checks before the call stop one leaving.
Small commits: stays a prompt line. It is guidance; a large commit costs a reviewer minutes and loses nothing.
Deletes: a pre-tool hook on a structured delete_paths tool that resolves each path and sends anything outside build/ to a person.

The hooks cost milliseconds per tool call and seconds per stop, against nine hours a month of force-push recovery alone. If the stop hook refuses on most sessions, the test subset is too broad, and that is the number to watch.

Rubric

says that rewording changes a rate, not a guarantee, with the rate computed
puts the push and delete rules in pre-tool hooks whose predicates check structured arguments
names branch protection on the remote as the floor beneath the hook
turns the test rule into a stop hook with a cap on refusals
treats the secret leak as prevention before the call, not redaction after it
leaves the commit-size rule in the prompt and says why

Where answers go wrong

"Make all five rules hooks." Small commits has no predicate a hook can check without blocking good work: a hook that rejects any commit over 200 lines stops the agent on its first large rename. Guidance stays in the prompt, as hooks separates the two.
"Add a post-tool hook that flags force-pushes." It fires after the push, when the commits are already overwritten. A post-tool hook can annotate a result; it cannot undo an effect.
"A pre-tool hook that blocks commands matching push --force." git push -f and git push origin +main both pass it. A deny-list over shell text is still a rate, just a smaller one; the predicate has to check arguments the agent cannot rephrase.