Repository navigation
fix(hooks): drop unpinned npx launcher string from hooks tree - #1205
Merged
Merged
Conversation
The plugin marketplace validator flagged UNPINNED_NPX against hooks/guards/hooks/policy-dispatch.sh. The script runs no launcher; the only npx text under hooks/ was prose in INSTALLED-SKILL-EDIT-GUARD.md naming an @latest skills-CLI command. Reword it so no launcher string remains under hooks/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What the validator said
The Claude Code plugin marketplace validator, run on main @ f9c4b1c, raised one blocking finding:
It also raised two informational HOOK_OUTPUT_UNINSPECTED notes (PreToolUse
BashandEdit|Write). Those aren't blockers; a reviewer reads the hook.What changed
hooks/guards/references/INSTALLED-SKILL-EDIT-GUARD.md: the onlynpxtext underhooks/was two lines of prose namingnpx skills@latest update/add. They now say "the next skills-CLI update (or a re-run of the skills-CLI add command)". The meaning is the same, and no launcher string is left in the hooks tree.policy-dispatch.shis unchanged on purpose. I audited it: every command word is spelled literally (jq,grep,printf,date,mkdir,cat,cut,sed,dirname,sha256sum/shasum/openssl). No variable or$(...)sits in command position and there is noeval. Changing it would be churn with no evidence behind it.installed-skill-edit-guard.sh,read-budget-guard.sh,codex-read-budget-guard.sh,scripts/install-hooks.sh,scripts/lint-policies.sh) contain no launcher strings and nocurl|wget ... | sh.Checks
grep -rnE "npx|bunx|pnpm dlx|yarn dlx|uvx|pipx run|uv run" hooks/: no matches (rc=1)bats --print-output-on-failure tests/scripts/policy-dispatch.bats: 51/51 okshellcheck -S warning hooks/guards/hooks/*.sh hooks/guards/scripts/*.sh: cleanbash hooks/guards/scripts/lint-policies.sh:OK (5 policies)claude plugin validate .: Validation passed (manifest check only; it does not run the security screens)Not verified
The marketplace validator's matching heuristic is undocumented and can't be run locally. My working assumption is that it scans the hooks tree as a unit and pinned the prose hit to the script. A re-run of the marketplace screen will confirm or refute that.