> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Installer wrappers

> Scan-first wrappers for skill installers. codegate skills and codegate clawhub preflight-scan install targets before allowing them to execute.

CodeGate provides two scan-first installer wrappers. Both wrappers intercept install subcommands, run a preflight scan on the target, and only proceed if policy allows.

* `codegate skills [skillsArgs...]` — wraps `npx skills`
* `codegate clawhub [clawhubArgs...]` — wraps `npx clawhub`

## How preflight scanning works

### `codegate skills`

When you run `codegate skills add <source>`, CodeGate:

1. Resolves the requested source target (GitHub URL, local path, or shorthand `owner/repo`).
2. Runs the full static scan pipeline against the resolved target.
3. If dangerous findings are detected (exit code `2`), aborts the install — fail-closed.
4. If warning-level findings are detected and `auto_proceed_below_threshold` is not `true`, prompts for confirmation (or aborts in non-interactive mode).
5. If policy allows, passes the original arguments through to `npx skills` to complete the install.

### `codegate clawhub`

When you run `codegate clawhub install <slug>`, CodeGate:

1. Resolves the skill slug to a canonical `clawhub.ai` URL and runs `clawhub inspect` to stage the remote skill content in a temporary directory.
2. Runs the full static scan pipeline against the staged content.
3. If dangerous findings are detected (exit code `2`), aborts the install — fail-closed.
4. If warning-level findings are detected and `auto_proceed_below_threshold` is not `true`, prompts for confirmation (or aborts in non-interactive mode).
5. If policy allows, passes the original arguments through to `npx clawhub` to complete the install. The temporary staged content is cleaned up after the install.

## Fail-closed behavior

<Warning>
  Both wrappers are fail-closed. If the preflight scan itself fails (for example, the source is unreachable or a parse error occurs), the install is aborted with exit code `3`. Use `--cg-force` to override this and proceed anyway.

  In non-interactive mode, warning-level findings also abort the install. Use `--cg-force` to skip the confirmation and proceed.
</Warning>

## Pass-through behavior

Non-install subcommands are passed directly to the underlying tool without any preflight scanning:

```bash theme={null}
# Passed through without scanning
codegate skills find security
codegate clawhub search security
```

## Wrapper flags

All `--cg-*` flags are consumed by CodeGate and are not forwarded to the underlying installer command.

<ParamField path="--cg-force" type="boolean" default="false">
  Continue with the install when the preflight scan fails or returns blocking findings. Also skips the warning-level confirmation prompt.
</ParamField>

<ParamField path="--cg-deep" type="boolean" default="false">
  Enable Layer 3 deep analysis during the preflight scan.
</ParamField>

<ParamField path="--cg-no-tui" type="boolean" default="false">
  Disable TUI and interactive prompts during the preflight scan.
</ParamField>

<ParamField path="--cg-verbose" type="boolean" default="false">
  Enable extended terminal output during the preflight scan.
</ParamField>

<ParamField path="--cg-include-user-scope" type="boolean" default="false">
  Include user/home config surfaces in the preflight scan.
</ParamField>

<ParamField path="--cg-collect" type="string">
  Preflight collection scope mode. Valid values: `default`, `project`, `user`, `explicit`, `all`. Repeatable.
</ParamField>

<ParamField path="--cg-collect-kind" type="string">
  Restrict preflight collection to specific artifact kinds. Valid values: `workflows`, `actions`, `dependabot`. Repeatable.
</ParamField>

<ParamField path="--cg-strict-collection" type="boolean" default="false">
  Treat parse failures in preflight-collected inputs as high-severity findings.
</ParamField>

<ParamField path="--cg-persona" type="string" default="regular">
  Preflight audit persona. Valid values: `regular`, `pedantic`, `auditor`.
</ParamField>

<ParamField path="--cg-runtime-mode" type="string" default="offline">
  Preflight runtime mode. Valid values: `offline`, `online`, `online-no-audits`.
</ParamField>

<ParamField path="--cg-workflow-audits" type="boolean" default="false">
  Enable the CI/CD workflow audit pack for preflight scans.
</ParamField>

<ParamField path="--cg-format" type="string" default="terminal">
  Preflight scan output format. Valid values: `terminal`, `json`, `sarif`, `markdown`, `html`.
</ParamField>

<ParamField path="--cg-config" type="string">
  Path to a specific CodeGate config file to use for the preflight scan.
</ParamField>

<ParamField path="--" type="string">
  Stop wrapper-option parsing. All arguments after `--` are forwarded to the underlying installer command unchanged.
</ParamField>

## Config policy controls

Wrapper preflight scans honor the same config policy controls as `codegate scan`, including `suppress_findings`, `suppression_rules`, `rule_pack_paths`, `allowed_rules`, and `skip_rules`.

## `codegate skills` examples

```bash theme={null}
# Basic install with preflight scan
codegate skills add https://github.com/vercel-labs/skills --skill find-skills

# Force install even if preflight scan returns blocking findings
codegate skills add https://github.com/owner/repo --skill security-review --cg-force

# Enable Layer 3 deep analysis during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-deep

# Workflow audit pack with project scope during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-workflow-audits --cg-collect project

# Restrict preflight collection to workflow files only
codegate skills add https://github.com/owner/repo --skill security-review --cg-collect-kind workflows

# Auditor persona with strict collection during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-strict-collection --cg-persona auditor

# Online runtime mode during preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-runtime-mode online

# Output preflight results as JSON
codegate skills add https://github.com/owner/repo --skill security-review --cg-format json

# Use a custom CodeGate config file for preflight
codegate skills add https://github.com/owner/repo --skill security-review --cg-config ~/.codegate/config.json

# Pass a custom flag directly to the skills installer (not scanned)
codegate skills add https://github.com/owner/repo --skill security-review -- --registry custom
```

## `codegate clawhub` examples

```bash theme={null}
# Basic install with preflight scan
codegate clawhub install security-auditor

# Install a specific version
codegate clawhub install security-auditor --version 1.0.0

# Enable Layer 3 deep analysis during preflight
codegate clawhub install security-auditor --cg-deep

# Workflow audit pack with project scope during preflight
codegate clawhub install security-auditor --cg-workflow-audits --cg-collect project

# Restrict preflight collection to workflow files only
codegate clawhub install security-auditor --cg-collect-kind workflows

# Auditor persona with strict collection during preflight
codegate clawhub install security-auditor --cg-strict-collection --cg-persona auditor

# Online runtime mode during preflight
codegate clawhub install security-auditor --cg-runtime-mode online

# Non-interactive preflight with JSON output
codegate clawhub install security-auditor --cg-no-tui --cg-format json

# Use a custom CodeGate config file for preflight
codegate clawhub install security-auditor --cg-config ~/.codegate/config.json

# Pass a custom registry flag directly to clawhub (not scanned)
codegate clawhub install security-auditor -- --registry https://registry.clawhub.ai

# Non-install subcommand — passed through without scanning
codegate clawhub search security
```

## Getting help

```bash theme={null}
codegate skills --help
codegate clawhub --help
```