Npm To Pnpm Rewriter
npx claude-code-templates@latest --mod productivity/npm-to-pnpm-rewriter Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-17
Partial analysis: some checks could not run on this component.
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Agent Config Directory AccessAgent Snooping · README.md:16
- MCP server referenced without pinned version: 'npx invocations'.MCP Rug Pull · .claude-plugin/plugin.json:4
- MCP server referenced without pinned version: 'npx invocations'.MCP Rug Pull · README.md:3
- MCP server referenced without pinned version: 'npx invocations'.MCP Rug Pull · SKILL.md:3
- MCP server referenced without pinned version: 'npx invocations'.MCP Rug Pull · hooks/hooks.json:2
Showing 5 of 9 observations. Learn more about NVIDIA SkillSpector.
Content
hooks/npm-to-pnpm-rewriter.ts. Options: manager (set in user or managed settings pluginConfigs, or /config). Run claude plugin validate on the installed folder to see every event it hooks and every $ call it makes.
npm-to-pnpm-rewriter
Rewrites npm / npx invocations to the package manager your project uses
(pnpm by default, yarn or bun via options). The "modifying" placement: the
hook forwards a copy of the event with a changed command to next, and
tells the model what ran through context (the model's own tool_use block
keeps the command it wrote, for prompt-cache stability).
Options
manager: "pnpm" | "yarn" | "bun" (default "pnpm")Declared in .claude-plugin/plugin.json (userConfig). Set them in /config, in user settings (~/.claude/settings.json, not project settings), with --settings <file> or in managed settings:
{ "pluginConfigs": { "npm-to-pnpm-rewriter@skills-dir": { "options": { } } } }Install
npx claude-code-templates@latest --mod productivity/npm-to-pnpm-rewriter
claudeIt is written to .claude/skills/npm-to-pnpm-rewriter/, which Claude Code auto-loads as npm-to-pnpm-rewriter@skills-dir. For one session with hot reload: claude --plugin-dir .claude/skills/npm-to-pnpm-rewriter. claude plugin validate .claude/skills/npm-to-pnpm-rewriter prints every event it hooks and every $ call it makes.
Requirements. Mods are on by default in Claude Code 2.1.287+. Typed against Anthropic's declarations: https://github.com/anthropics/claude-code/tree/main/mods