Installer wrappers

Scan-first wrappers for skill installers. codegate skills and codegate clawhub preflight-scan install targets before allowing them to execute.

CodeGate provides two scan-first installer wrappers. Both wrappers intercept install subcommands, run a preflight scan on the target, and only proceed if policy allows.

• codegate skills [skillsArgs...] — wraps npx skills
• codegate clawhub [clawhubArgs...] — wraps npx clawhub

How preflight scanning works

codegate skills

When you run codegate skills add <source>, CodeGate:

1. Resolves the requested source target (GitHub URL, local path, or shorthand owner/repo).
2. Runs the full static scan pipeline against the resolved target.
3. If dangerous findings are detected (exit code 2), aborts the install — fail-closed.
4. If warning-level findings are detected and auto_proceed_below_threshold is not true, prompts for confirmation (or aborts in non-interactive mode).
5. If policy allows, passes the original arguments through to npx skills to complete the install.

codegate clawhub

When you run codegate clawhub install <slug>, CodeGate:

1. Resolves the skill slug to a canonical clawhub.ai URL and runs clawhub inspect to stage the remote skill content in a temporary directory.
2. Runs the full static scan pipeline against the staged content.
3. If dangerous findings are detected (exit code 2), aborts the install — fail-closed.
4. If warning-level findings are detected and auto_proceed_below_threshold is not true, prompts for confirmation (or aborts in non-interactive mode).
5. If policy allows, passes the original arguments through to npx clawhub to complete the install. The temporary staged content is cleaned up after the install.

Fail-closed behavior

Both wrappers are fail-closed. If the preflight scan itself fails (for example, the source is unreachable or a parse error occurs), the install is aborted with exit code 3. Use --cg-force to override this and proceed anyway.

In non-interactive mode, warning-level findings also abort the install. Use --cg-force to skip the confirmation and proceed.

Pass-through behavior

Non-install subcommands are passed directly to the underlying tool without any preflight scanning:

# Passed through without scanning
codegate skills find security
codegate clawhub search security

Wrapper flags

All --cg-* flags are consumed by CodeGate and are not forwarded to the underlying installer command.

--cg-force · boolean · default: "false"

Continue with the install when the preflight scan fails or returns blocking findings. Also skips the warning-level confirmation prompt.

--cg-deep · boolean · default: "false"

Enable Layer 3 deep analysis during the preflight scan.

--cg-no-tui · boolean · default: "false"

Disable TUI and interactive prompts during the preflight scan.

--cg-verbose · boolean · default: "false"

Enable extended terminal output during the preflight scan.

--cg-include-user-scope · boolean · default: "false"

Include user/home config surfaces in the preflight scan.

--cg-collect · string

Preflight collection scope mode. Valid values: default, project, user, explicit, all. Repeatable.

--cg-collect-kind · string

Restrict preflight collection to specific artifact kinds. Valid values: workflows, actions, dependabot. Repeatable.

--cg-strict-collection · boolean · default: "false"

Treat parse failures in preflight-collected inputs as high-severity findings.

--cg-persona · string · default: "regular"

Preflight audit persona. Valid values: regular, pedantic, auditor.

--cg-runtime-mode · string · default: "offline"

Preflight runtime mode. Valid values: offline, online, online-no-audits.

--cg-workflow-audits · boolean · default: "false"

Enable the CI/CD workflow audit pack for preflight scans.

--cg-format · string · default: "terminal"

Preflight scan output format. Valid values: terminal, json, sarif, markdown, html.

--cg-config · string

Path to a specific CodeGate config file to use for the preflight scan.

-- · string

Stop wrapper-option parsing. All arguments after -- are forwarded to the underlying installer command unchanged.

Config policy controls

Wrapper preflight scans honor the same config policy controls as codegate scan, including suppress_findings, suppression_rules, rule_pack_paths, allowed_rules, and skip_rules.

codegate skills examples

# Basic install with preflight scan
codegate skills add https://github.com/vercel-labs/skills --skill find-skills

# Force install even if preflight scan returns blocking findings
codegate skills add https://github.com/owner/repo --skill security-review --cg-force

# Enable Layer 3 deep analysis during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-deep

# Workflow audit pack with project scope during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-workflow-audits --cg-collect project

# Restrict preflight collection to workflow files only
codegate skills add https://github.com/owner/repo --skill security-review --cg-collect-kind workflows

# Auditor persona with strict collection during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-strict-collection --cg-persona auditor

# Online runtime mode during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-runtime-mode online

# Output preflight results as JSON
codegate skills add https://github.com/owner/repo --skill security-review --cg-format json

# Use a custom CodeGate config file for preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-config ~/.codegate/config.json

# Pass a custom flag directly to the skills installer (not scanned)
codegate skills add https://github.com/owner/repo --skill security-review -- --registry custom

codegate clawhub examples

# Basic install with preflight scan
codegate clawhub install security-auditor

# Install a specific version
codegate clawhub install security-auditor --version 1.0.0

# Enable Layer 3 deep analysis during preflight
codegate clawhub install security-auditor --cg-deep

# Workflow audit pack with project scope during preflight
codegate clawhub install security-auditor --cg-workflow-audits --cg-collect project

# Restrict preflight collection to workflow files only
codegate clawhub install security-auditor --cg-collect-kind workflows

# Auditor persona with strict collection during preflight
codegate clawhub install security-auditor --cg-strict-collection --cg-persona auditor

# Online runtime mode during preflight
codegate clawhub install security-auditor --cg-runtime-mode online

# Non-interactive preflight with JSON output
codegate clawhub install security-auditor --cg-no-tui --cg-format json

# Use a custom CodeGate config file for preflight
codegate clawhub install security-auditor --cg-config ~/.codegate/config.json

# Pass a custom registry flag directly to clawhub (not scanned)
codegate clawhub install security-auditor -- --registry https://registry.clawhub.ai

# Non-install subcommand — passed through without scanning
codegate clawhub search security

Getting help

codegate skills --help
codegate clawhub --help