lifecycle-hooks-19ec3e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lifecycle-hooks-19ec3e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill documents the session-start lifecycle hooks used by the dev-tools package. These hooks run automatically at session initialization to ensure cross-plugin references resolve correctly in cached environments.
When plugins are installed from a marketplace/registry, each plugin is cached in an isolated directory with organization-prefixed names and version subdirectories. Cross-plugin references (e.g., loading a skill from a sibling plugin via relative paths) break because the directory structure differs from the local development monorepo layout.
Local monorepo layout:
claude/
├── core-tools/ <- ../core-tools/ resolves naturally
├── dev-tools/
└── claude-tools/Cached plugin layout:
plugins/cache/org-name/
├── org-name-core-tools/
│ └── 0.2.3/ <- long path, org-prefixed name
├── org-name-dev-tools/
│ └── 0.3.4/
└── org-name-claude-tools/
└── 0.2.5/The resolve-cross-plugins.sh script (in references/) runs at session start and creates short-name symlinks at the plugin-name directory level so that ../{short-name}/ resolves correctly in both environments.
After script runs:
plugins/cache/org-name/org-name-dev-tools/
├── 0.3.4/ <- actual plugin content
├── core-tools -> ../org-name-core-tools/0.2.3 <- symlink
└── claude-tools -> ../org-name-claude-tools/0.2.5 <- symlinkThe hook runs as a session_start event of type command:
event: session_start
type: command
command: bash <plugin_root>/hooks/resolve-cross-plugins.sh <plugin_root>
timeout: 10The resolve-cross-plugins.sh script:
/plugins/cache/). In local monorepo development, the script exits immediately since relative paths already work.org-name-core-tools -> core-tools).installed_plugins.json from the agent configuration directory (requires jq)ln -sfn) from the short name to the resolved version directory. Skips if a real (non-symlink) directory already exists with that name.AGENT_ALCHEMY_HOOK_DEBUG=1 environment variable.If your platform uses a different plugin caching mechanism:
../{short-name}/ resolves to the correct version of each sibling pluginWhat this component does: Provides a session-start hook that creates short-name symlinks for cross-plugin dependency resolution in cached/installed plugin environments, ensuring that relative path references between plugin packages work correctly. Capabilities needed: Shell execution (bash script with ln, jq), file system access (symlink creation in plugin cache directory). Adaptation guidance: This hook addresses a specific problem with cached plugin directory layouts. If your platform resolves cross-package references differently (e.g., through a module system, import maps, or path aliases), you may not need this hook. The script in references/resolve-cross-plugins.sh can serve as a reference implementation. The key requirement is that ../{package-short-name}/ relative paths must resolve from any sibling plugin's root directory.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.