Open-source CLI that blocks risky npm, pnpm, and bun installs before they run.
This repository also configures its own agents. See what SafeInstall tells them →
Skill Codex
Check an npm package or proposed dependency with the existing SafeInstall engine before recommending or installing it. Use for release-age, install-script, provenance, typo-squat and package-policy questions. A check is not authorization to execute registry code.
Skill Codex
Install or add requested npm or pnpm dependencies through SafeInstall's existing artifact-bound installation gate. Use when a user requests dependency installation, including development dependencies. Never use for arbitrary registry-code execution or to bypass a policy block.
Skill Codex
Set up the existing SafeInstall policy and trust baseline in a local npm or pnpm project, or help a user enable the SafeInstall plugin hook. Use for SafeInstall onboarding and protection setup, not unrelated package installations.
Skill Codex
Inspect an existing SafeInstall project's policy and trust-surface status without changes. Use for protection status, configuration drift, minimum CLI version and whether SafeInstall has been set up. Do not equate a matching trust baseline with active host hook enforcement.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: