Identifies npm security and pinning compliance issues across Node.js repositories.
npx skills add https://github.com/jluckyiv/rivcomocktrial --skill audit-deps-jluckyiv
Please help me install this Agent Skill. Skill: audit-deps Source: https://github.com/jluckyiv/rivcomocktrial/tree/main/.claude/skills/audit-deps Command: npx skills add https://github.com/jluckyiv/rivcomocktrial --skill audit-deps-jluckyiv
This skill surfaces security-relevant dependency state and pin compliance: npm audit findings, major-version drift, unpinned GHA actions, unpinned Docker base images, and unverified binary downloads. It enables run-on-demand and monthly reviews to keep repositories secure and compliant.
Run the deps-checks.sh script at the repository root to generate a security and pin-compliance report.
High-intent search queries and answers about installing and using this skill.
To audit npm dependencies and check pinning, run a scanning script at the repository root that analyzes package manifests, workflow files, and Dockerfiles across monorepo sub-packages to surface security findings and pin compliance issues.
Find unpinned Docker base images and unverified binary downloads by scanning Dockerfiles and CI/CD configurations for version tags, branch pins, and SHA pinning quality to generate actionable security and compliance reports.
Yes, this dependency audit requires npm, rg (ripgrep), and jq as dependencies to scan project files, analyze package manifests, and output categorized security and pin compliance findings for remediation.
Yes, you can run on-demand or monthly security reviews to surface npm audit findings, major-version drift, unpinned GitHub Actions, and Docker base image compliance issues across root and sub-packages for developers and SREs.
The scanning is limited to Node.js projects with monorepos and CI/CD configurations, analyzing npm packages, GitHub Actions, and Dockerfiles, and requires npm, rg, and jq to run on-demand or monthly audits.
ImaginerLabsGenerate GitHub Actions workflows, Dockerfiles, and Kubernetes manifests for Node.js applications.
tacogipsPin GitHub Actions to commit SHAs and enforce minimal permissions.
pohlai88Audit monorepo dependencies for vulnerabilities, license issues, and version drift.
telihaAnalyze GitHub Actions workflows for security, permissions, and reusable architecture.
