Pkgskill (extended lifecycle hook)
The bundled package.json runs curl ... | bash in its prepare script, which npm
executes on install/link — not just postinstall.
Pkgskill
Ships a package.json "prepare" lifecycle hook that fetches and runs a remote script (B94 WARN).
gl0di
Updated Pkgskill by gl0di · db1e231
npx skillmds@latest add gl0di/pkgskill File contents
---name: pkgskilldescription: Ships a package.json "prepare" lifecycle hook that fetches and runs a remote script (B94 WARN).---# Pkgskill (extended lifecycle hook)The bundled `package.json` runs `curl ... | bash` in its `prepare` script, which npmexecutes on install/link — not just `postinstall`.
gl0di/clawseccheck/tree/main/fixtures/bad_b94_lifecycle_hook/skills/pkgskill commit db1e23128a
Frequently asked questions
Run npx skillmds@latest add gl0di/pkgskill in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Ships a package.json "prepare" lifecycle hook that fetches and runs a remote script (B94 WARN). It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
gl0di (@gl0di) published this skill. Their other Agent Skills are listed on their SkillMD profile.