detect undeclared install script
toolchain-wide catalog and package interception