skills.rest
staticaland
staticalandCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

install-scripts

Blocks dependency install scripts in npm and uv, then allowlists packages that build native binaries.

4|Updated Jan 29, 2026
Search Tags:#npm#uv#supply chain security#postinstall#install scripts#ignore-scripts#dependency hardening
One-click install
npx skills add https://github.com/staticaland/skills --skill install-scripts-staticaland
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: install-scripts
Source: https://github.com/staticaland/skills/tree/main/plugins/dependencies/skills/install-scripts
Command: npx skills add https://github.com/staticaland/skills --skill install-scripts-staticaland

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Dependency install scripts (preinstall, install, postinstall) execute arbitrary code with your shell, environment, CI tokens, and SSH keys before anyone reviews the package - the exact propagation path of supply-chain worms like Shai-Hulud. This Skill hardens npm and uv projects by denying install scripts by default and allowlisting only the few packages that genuinely build something. ## Core Features & Use Cases - Audit install-time code execution: Lists every package that runs code at install time by reading hasInstallScript flags from package-lock.json and running uv sync --no-build --dry-run, plus the project's own lifecycle scripts. - Deny by default everywhere: Commits ignore-scripts=true to .npmrc for npm and applies --no-build --no-install-project for uv, covering CI, Docker image builds, task runners, and deploy scripts. - Allowlist with reasons: Rebuilds only the packages that need it (e.g., esbuild, fsevents) via npm rebuild --ignore-scripts=false --foreground-scripts, with each allowlisted package documented alongside its reason. - Use Case: After a supply-chain attack hits the ecosystem, you run this Skill to lock down every install site in your repo, verify with a fresh npm ci --foreground-scripts that no unexpected scripts execute, and restore your project's own pretest/prepare hooks explicitly. ## Quick Start Audit this repository for dependency install scripts, then configure npm and uv to deny them by default with an allowlist for packages that build native binaries.

Frequently Asked Questions about install-scripts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I disable npm postinstall scripts for all dependencies?▼

Commit ignore-scripts=true to a project-level .npmrc file so CI, contributors, and image builds share the setting. Then rebuild only the packages that need scripts using npm rebuild --ignore-scripts=false --foreground-scripts followed by the package names.

How do I find which npm packages run install scripts?▼

Read the lockfile without installing anything: run jq to select entries in package-lock.json where hasInstallScript is true. This flags preinstall, install, and postinstall scripts, though prepare scripts for git dependencies require checking each manifest.

Does uv have an equivalent to npm ignore-scripts?▼

Yes, uv sync --no-build refuses to build any source distribution, which is where Python install-time code runs. Pair it with --no-install-project and install the project itself in a second step, since uv has no per-package allowlist.

Why does npm rebuild do nothing when ignore-scripts is set?▼

A project-wide ignore-scripts=true also applies to npm rebuild, so it reports success while running nothing. Pass --ignore-scripts=false explicitly to the rebuild command, and add --foreground-scripts to confirm each script actually executed.

What happens to my project's own pretest and prepare scripts?▼

The deny silences them quietly: npm test still runs but its pretest hook stops firing. Call hooks explicitly (npm run pretest && npm test) or fold them into the main script, and run prepare work like husky as its own command.

Does blocking install scripts fully protect against malicious packages?▼

No. A package can still execute code when your project imports it, and the deny says nothing about which version arrived. Pair it with a dependency cooldown so fresh releases age first and frozen installs so every site installs the same tree.

Related Skills

Explore More Software Engineering Skills→
Silac1995Silac1995

package-list

List installed Unity Package Manager packages with name, version, source, and description.

Community
Intermediate
SgtPookiSgtPooki
1

dep-verify

Audits dependency-update PRs for compatibility and supply-chain integrity before merging.

Community
Advanced
dotBeepsdotBeeps

dependency-management

Manage dependency add, remove, update, and audit operations across Bun, uv, Cargo, Go modules, and Gradle.

Community
Intermediate
camoneartcamoneart
5

Enforcing pnpm

Enforce pnpm as the exclusive package manager and convert npm/yarn commands.

Community
Basic