From hydra-package-gate
Helps the developer interpret package-gate advisory findings and decide whether to proceed with a package install. Use when the developer asks about a package-gate warning, supply-chain risk on a specific package, slopsquat / typosquat / maintainer-churn / download-cliff signals, or whether an `npm install` / `pip install` / `pnpm add` / `yarn add` / `uv add` target is safe. Auto-triggers on: "is X safe to install", "package-gate flagged", "typosquat", "slopsquat", "supply-chain risk", "should I install", "this package looks suspicious". Do not use for: post-install vulnerability scans (see vuln-detector), secrets in installed code (see secret-scanner), or actually blocking installs — package-gate is advisory only and the install was not blocked.
How this skill is triggered — by the user, by Claude, or both
Slash command
/hydra-package-gate:gate-awarenessThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
<purpose>
<signal_glossary>
<decision_tree> IF developer asks about a specific gate finding: → Identify the package + signal from the advisory block in context. → Explain the signal (use signal_glossary). → Recommend: check registry page, verify maintainer, look at GitHub repo + open issues, prefer a popular alternative if typosquat.
IF developer asks "is X safe":
→ Run: bash ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.sh on a synthetic
npm install X payload (or call gate-check.py directly with
python3 ${CLAUDE_PLUGIN_ROOT}/scripts/gate-check.py "npm install X").
→ Report findings, severity-ordered.
→ Note this is advisory — final call is the developer's.
IF gate flagged but developer wants to proceed anyway: → Acknowledge — package-gate does NOT block. → Suggest pinning the version, reading the source, sandboxing the install (e.g., separate venv / disposable container) for HIGH-sev flags. </decision_tree>
<output_format>
Signal: () Reason: What it means:
Recommended next step:
This is advisory; the install was not blocked. </output_format>
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub enchanter-ai/hydra --plugin package-gate