IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Extend your assistant
Priya's AGENTS.md says "Never edit .env files." One day, her agent edited it anyway. Your goal: pick the right way to extend your assistant.
🧪 Interactive lab — enable JavaScript to play with this one.
- A line in the instruction file is advice. The model usually follows it.
- A hook is a small program the tool runs at fixed moments. The model can't skip it.
- Use hooks for "must always" and "must never" rules.
- Hooks, skills, MCP servers and plugins can run code as you.
Which one do I need?
The instruction file loads in every session. The rest build on it.
| If you need… | Use |
|---|---|
| A short fact every session needs | A line in the instruction file |
| A request you run often, when you choose | A custom command |
| Long know-how for some tasks only | A skill |
| Something that must always or never happen | A hook |
| Access to an outside system | An MCP server |
| A big, noisy job on its own | A subagent |
| One setup for the whole team | A plugin |
Hooks: rules the model can't skip
A written rule is text, like a "Do not enter" sign. The model decides whether to obey. An agent hook is a small program instead, like a locked door. The tool runs it at fixed moments, like before each edit. Priya's new hook blocks edits to .env, the file that holds her secret keys.
Next, Priya downloads a project from a forum post. Check its files first.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: commands and skills
A slash command is a prompt you save once. Then you run it by name, like /release-notes. It can take an input, such as a version number. You decide when it runs.
A skill is a folder of know-how with a SKILL.md file (Agents, subagents and skills). Only its short description sits in context. The full steps load when a task matches. The model can pick a skill by itself. You can often call it by name, too.
As of October 2026, commands and skills are merging in several tools. Skills also follow an open format, called Agent Skills. Both are still just text for the model. A skill that says "always run the linter" is a strong hint, not a promise.
Go deeper: when hooks run
A hook runs at a fixed point in a session. Here are the usual points, in order:
- Session start. A hook can load today's ticket into context.
- You send a prompt. Hooks can run here, too.
- Before a tool runs. A hook can check the request and block it. The usual signal is exit code 2, or a short JSON answer that says "deny". The agent reads the reason.
- After a tool runs. A hook can run the formatter on the file that just changed.
- The agent says it is done. A hook can run the tests. If they fail, it sends the agent back to work (Tests, checks and debugging).
A hook can also alert you when the agent waits for your approval. Hooks are normal programs. They run with your full user permissions. A slow hook slows every step. A buggy one can block work you wanted.
Go deeper: MCP servers and subagents
Does the agent need a system outside the project, like the issue tracker or a database? Connect an MCP server. It gives the agent new tools (MCP: plug tools into AI). Each server is software you install. Each tool description also uses context on every turn.
Some jobs would flood your context. Examples are searching 2,000 files, reading a long log, or reviewing a diff with fresh eyes. Give that job to a subagent. It works in its own context and sends back only a summary.
You can define your own subagent in a small file. It has a name, a description and its own instructions. The main agent reads the description to decide when to hand off work. A subagent often gets fewer tools, or a smaller, cheaper model. A good first one is a reviewer that can read code but not edit it.
Go deeper: plugins
Priya's teammates wanted her hooks, commands and reviewer, too. An agent plugin packs them up. The team installs it in one step. Plugins often come from a marketplace, a list of plugins to choose from. As of October 2026, Claude Code, the Copilot CLI, Cursor, Codex and Google's Antigravity CLI all have plugins.
A plugin you install can run code with your permissions. So install plugins only from sources you trust.
Some extensions come inside a project you download. Many tools ask you to trust the folder first. Read what you trust.
Save this as block-env.sh.
grep -q '"file_path": *"[^"]*\.env"' && echo "No .env edits" >&2 && exit 2 || exit 0
Test it: echo '{"file_path":"app/.env"}' | sh block-env.sh. Then run echo $?. You see 2. For app/main.js, you see 0. Hooks pages: