Skip to content
Back to skills

Node

ASecurity

Runs Node and npm for the markdownlint hook and other tools. Use when npm or npx fails or resolves the wrong node binary, often on WSL.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 5, 2026
developmentshellnodegit

Works with

  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned November 5, 2026

npx -y skills add niksavis/handily --skill node --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Node?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Node
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/niksavis-node/badge)](https://www.skillsdirectory.com/skills/niksavis-node)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: node
description: Runs Node and npm for the markdownlint hook and other tools. Use when npm or npx fails or resolves the wrong node binary, often on WSL.
---
<!-- Generated by `basicly skills-build` from skill.yaml. Do not edit; edit the source. -->

# Node

Run node tooling so that it uses the Linux node and the pinned packages. The markdownlint
git hook needs `markdownlint-cli2` from `package-lock.json`.

## Rules

- **Install with `npm ci`, not `npm install`.** It installs exactly what
  `package-lock.json` pins. Commit the lockfile with each dependency change.
- **Run a tool with `npx --no-install <tool>`.** It runs the pinned local package and
  refuses to download a different version.
- **Put the Linux node on `PATH` before a script or background job runs node or npx.** A
  non-interactive shell does not load nvm, so WSL can find a Windows node instead.
- **Ask before you add a dependency.** It is on the confirmation list.

## The markdownlint hook

The hook finds node itself and never calls `npx`. It uses the first usable node from this
list, and never a Windows node under `/mnt`:

1. `node` on `PATH`
2. the newest node under nvm (`$NVM_DIR`, or `~/.nvm`)
3. `/usr/local/bin/node`, then `/usr/bin/node`

The hook and `basicly install` refuse missing prerequisites before reporting success.
Install checks before writing files, including with `--dry-run`. Read the refusal:

| Message | Fix |
| --- | --- |
| *node_modules/markdownlint-cli2/... is missing* | Run `npm ci` when the package is locked. Otherwise get approval, then run `npm install --save-dev markdownlint-cli2` and commit the package files. |
| *no usable node found on PATH, under nvm, or in /usr/bin* | Install a Linux node, for example `nvm install --lts`. |

The enabled hook reads inputs from the repository's `.markdownlint-cli2.jsonc`,
`.markdownlint-cli2.yaml`, `.markdownlint-cli2.cjs` or `.markdownlint-cli2.mjs`.
A style-only `.markdownlint.json` file does not select CLI2 inputs. Keep existing input and
rule choices; install creates no Markdown policy. Before a first commit, configure
real consumer Markdown inputs. The first-loop tutorial explicitly chooses `README.md`
and `NOTES.md`, with a clean README and every default rule enabled.

Only an explicit configuration opts out. The hook then prints `markdownlint: opted out by
hooks.markdownlint.enabled=false` and exits 0:

```toml
[hooks.markdownlint]
enabled = false
```

The hook reads `basicly.toml`, sorted `basicly.d/*.toml`, then `basicly.local.toml`.
Later settings win. A malformed setting refuses. A technology selection excluding Node
does not install the markdown gate or require its runtime.

## Node in a non-interactive shell on WSL

A script, a background job or a hook does not load your shell profile. Then `node` and
`npx` can resolve to a Windows install. The fix is in
[references/wsl-node-path.md](references/wsl-node-path.md). The `wsl` skill covers the
general interop model.

Files in this skill

  • SKILL.md2.9 KB
  • references/wsl-node-path.md1.1 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.