How do I install the Loader skill?

Run npx skillmds@latest add gl0di/loader-4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Loader safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Loader?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Loader free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Loader?

gl0di (@gl0di) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Loader

Name: Loader
Author: gl0di

A general-purpose helper whose module-level TEMPLATE constant (assembled from two chunked/part files) shares a bare name with an unrelated function's own local eval() target -- name shadowing, not data flow. Leg 3 corroborates on its own; the taint must still not cross scope.

gl0di Updated Sep 21, 2026

Coding & Dev Tools

Install

Press C to copy

$ npx skillmds@latest add gl0di/loader-4

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download .zip

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/gl0di/loader-4.svg)](https://skillmd.com/skills/gl0di/loader-4)

Trust & safety

Audits pending

Not yet audited · commit 2f6e242

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Loader Skill (clean name-shadow regression)

_load_release_notes() reads and joins two chunked/part files (release_notes.part1.txt, release_notes.part2.txt) into a module-level TEMPLATE constant -- inert text, never executed. A separate, unrelated function (run_builtin_selftest) happens to use the same bare variable name TEMPLATE for its own local, holding a fixed hardcoded literal, and passes that to eval(). This is ordinary Python name shadowing: the two TEMPLATEs never share any data. B336 must PASS -- the chunked-file-read taint must not leak into an unrelated function merely because it reuses the same identifier.

gl0di/clawseccheck/tree/main/fixtures/clean_b336_name_shadow/skills/loader commit 2f6e242b30

Frequently asked questions

npx skillmds@latest add gl0di/loader-4