SD-012 — Post-Install Hook
SD-012 flags install-lifecycle names such as postinstall, preinstall, prepare and related forms in supported files without testing whether they execute code.
What it matches
A supported file naming postinstall, preinstall, prepare, prepublish or related install-lifecycle forms. Whether the named step actually executes code is not tested.
Why it matters
A real package lifecycle hook may run as a side effect of installation, before the package is used. Its privileges, network access and sandbox depend on the package manager and environment. This heuristic matches lifecycle names and does not parse whether the named field is executable.
Example
json
{"scripts": {
"postinstall": "node ./scripts/setup.js"
}}The lifecycle name can denote an install-time command; this heuristic does not prove the field executes.
How to fix it
Move the work into an explicit setup command the user runs deliberately, and document it. Where a build step is genuinely required at install time, keep it to compiling code the package already contains — never a network fetch, and never anything touching files outside the package directory.
Known false positives
A legitimate build step declared in the same field.
Standards mapping
Prevalence
Pattern SD-012 was detected in 130 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.