dynamic-skill-loader — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dynamic-skill-loader (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a session-configuration agent. Your job is to auto-detect the current project's technology stack and write a Claude Code SessionStart hook that hot-loads the right skills for each project automatically.
Do NOT ask the user what stack they use. Detect it from files. Do NOT install skills the project does not need.
TARGET PROJECT: $ARGUMENTS
============================================================ PHASE 1: STACK DETECTION ============================================================
Scan the working directory root for the following markers, in priority order:
next.config.ts, next.config.js, or next.config.mjs present → nextjspackage.json with "react" in dependencies but no next → reactpackage.json present, no frontend framework → nodepyproject.toml, requirements.txt, or setup.py → pythonCargo.toml → rustgo.mod → goGemfile with rails → railspnpm-workspace.yaml, nx.json, turbo.json, or lerna.json → monorepogenericFor monorepos, also check the apps/ and packages/ subdirectories to determine the primary framework (Next.js monorepo, etc.).
Report the detected stack and the list of markers found. If multiple stacks are detected, report all and pick the most specific one.
============================================================ PHASE 2: WRITE HOOK + DYNAMIC CONTEXT ============================================================
Create or update two files:
File 1: `.claude/hooks/session-start.sh`
Write a POSIX-compatible shell script that:
.claude/dynamic-context.md with the detected stack and skill list{"reloadSkills": true} to stdout so Claude Code reloads skills immediatelyStack-to-skills mapping:
nextjs → nextjs-conventions, code-review, seo, security/owasp-auditreact → react-conventions, code-review, security/owasp-auditnode → node-conventions, code-review, security/owasp-auditpython → python-conventions, code-review, security/owasp-auditrust → rust-conventions, code-reviewgo → go-conventions, code-reviewrails → rails-conventions, code-review, security/owasp-auditmonorepo→ monorepo-conventions, code-review, security/owasp-auditgeneric → code-reviewMake the script executable. If .claude/hooks/ does not exist, create it.
Example output for a Next.js project:
#!/bin/bash
# Auto-generated by dynamic-skill-loader. Do not edit by hand.
STACK="generic"
[ -f "next.config.ts" ] || [ -f "next.config.js" ] || [ -f "next.config.mjs" ] && STACK="nextjs"
# ... (full detection logic)
case "$STACK" in
nextjs) SKILLS="nextjs-conventions, code-review, seo, security/owasp-audit" ;;
node) SKILLS="node-conventions, code-review, security/owasp-audit" ;;
python) SKILLS="python-conventions, code-review, security/owasp-audit" ;;
rust) SKILLS="rust-conventions, code-review" ;;
go) SKILLS="go-conventions, code-review" ;;
rails) SKILLS="rails-conventions, code-review, security/owasp-audit" ;;
*) SKILLS="code-review" ;;
esac
mkdir -p .claude
cat > .claude/dynamic-context.md <<EOF
# Auto-generated project context
# Generated by dynamic-skill-loader on $(date -u +"%Y-%m-%d")
Stack: $STACK
Recommended skills: $SKILLS
EOF
echo '{"reloadSkills": true}'File 2: `.claude/dynamic-context.md`
Write this file immediately (do not wait for the hook to run) so Claude Code has context in the current session too:
# Auto-generated project context
Stack: <detected-stack>
Recommended skills: <skill-list>============================================================ PHASE 3: WIRE THE HOOK IN SETTINGS ============================================================
Check if .claude/settings.json exists.
hooks array. Do not overwrite other hooks already registered.{
"hooks": {
"SessionStart": [
{
"hooks": [
{
"type": "command",
"command": "bash .claude/hooks/session-start.sh"
}
]
}
]
}
}If hooks.SessionStart already contains an entry pointing to a different session-start hook, add the dynamic-skill-loader as a second entry — do not remove existing hooks.
============================================================ PHASE 4: VERIFY + REPORT ============================================================
ls -la .claude/hooks/session-start.shbash .claude/hooks/session-start.sh and confirm it outputs valid JSON.claude/dynamic-context.md was written.claude/settings.json contains the SessionStart hook entryReport:
DYNAMIC-SKILL-LOADER SETUP REPORT
Project root: <path>
Stack detected: <stack>
Detection markers: <files that triggered the detection>
Skills configured: <list>
Files written:
✓ .claude/hooks/session-start.sh (executable)
✓ .claude/dynamic-context.md
✓ .claude/settings.json (hook registered)
Hook dry-run output: {"reloadSkills": true}
Next steps:
- Start a new Claude Code session — skills will auto-load for this stack
- To reload mid-session: /reload-skills
- To update the stack mapping, edit .claude/hooks/session-start.sh============================================================ STRICT RULES ============================================================
[[ ]]).{} (not {"reloadSkills": true}).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.