# Scan Package

> Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands. Trigger phrases (English): 'is this safe to install', 'check this package before installing', 'scan this skill', 'vet this MCP server', 'is this npm package safe', 'is this pip package safe'. Trigger phrases (Chinese): '安全扫描', '这个插件安全吗', '这个技能安全吗', '扫描一下', '安装前检查'.

- Skill: `nomarj/scan-package` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nomarj/scan-package`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nomarj/scan-package/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: nomarj (https://skillmd.com/u/nomarj)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nomarj/scan-package

---


# Package Security Scan

Scan a package before installation:

1. Identify package type (pip or npm)
2. Run appropriate Sigil scan:
   - `sigil pip <package>` for Python packages
   - `sigil npm <package>` for Node packages
3. Review quarantine findings
4. Recommend approve/reject based on risk score

**Critical patterns to flag:**
- Install hooks (setup.py cmdclass, npm postinstall)
- Eval/exec/pickle usage
- Network exfiltration (webhooks, DNS tunneling)
- Credential access (ENV vars, SSH keys)
- Code obfuscation (base64, charCode)

Present findings and guide the user through quarantine approval.