skills.rest
SleyiW
SleyiWCOMMUNITY
Explore all skills by this author →
GitHub

codebase-cleanup-deps-audit

Audit pnpm monorepo dependencies for CVEs, licenses, outdated packages, and supply chain risks.

Updated Apr 4, 2026
Search Tags:#pnpm#monorepo#dependency audit#cve#supply chain security#license compliance#lockfile
One-click install
npx skills add https://github.com/SleyiW/iWana-neXt --skill codebase-cleanup-deps-audit-sleyiw
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codebase-cleanup-deps-audit
Source: https://github.com/SleyiW/iWana-neXt/tree/main/.agents/skills/codebase-cleanup-deps-audit
Command: npx skills add https://github.com/SleyiW/iWana-neXt --skill codebase-cleanup-deps-audit-sleyiw

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It standardizes dependency security audits for the iWana neXt pnpm monorepo, ensuring vulnerabilities, license conflicts, and outdated packages are caught before releases or merges to main. ## Core Features & Use Cases - Vulnerability Auditing: Runs pnpm audit across the monorepo or per workspace, with a severity-based action matrix for critical, high, moderate, and low findings. - Remediation Guidance: Covers direct updates, pnpm overrides for forced fixes, lockfile verification, and license compatibility review. - Use Case: Before a release, run the pre-release checklist to confirm pnpm audit --prod shows no unaddressed critical or high vulnerabilities, the lockfile is synchronized, and TruffleHog reports no secrets in CI. ## Quick Start Audit the dependencies of the @iwana/api workspace and tell me which vulnerabilities block the next release.

Frequently Asked Questions about codebase-cleanup-deps-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit dependencies in a pnpm monorepo?▼

Run pnpm audit for the whole monorepo, pnpm audit --prod for production dependencies only, or pnpm --filter <workspace> audit for a specific workspace. Never use npm audit or yarn audit in a pnpm project.

How do I fix a vulnerability when no direct update is available?▼

Add a pnpm override in the root package.json under pnpm.overrides forcing the vulnerable package to a safe version, then reinstall. Document the override with the CVE that justifies it.

Which dependency licenses are safe for production use?▼

MIT, Apache 2.0, BSD, and ISC licenses are compatible for production dependencies. GPL and AGPL require review before inclusion, and commercial licenses without a contract should not be included. Check with pnpm licenses list.

Why should I avoid npm audit fix --force in a pnpm project?▼

npm audit fix --force overwrites the pnpm lockfile and breaks the monorepo. Use pnpm update for specific packages or pnpm overrides instead, and verify with pnpm install --frozen-lockfile.

When should I not use this dependency audit workflow?▼

Do not use it for source code security reviews, which belong to a security-auditor skill, or for infrastructure configuration, which belongs to a docker-expert skill. It covers only dependency and supply chain auditing.

Related Skills

Explore More Software Engineering Skills→
Parallel-7Parallel-7
76

npm-to-pnpm

Convert npm lockfiles and configure pnpm workspaces for migration.

Official
Advanced
authgearauthgear
2.0k

update-deps

Audit and fix dependency vulnerabilities in Go modules and npm packages.

Official
Advanced
amanning3390amanning3390
13

security-auditor

Scan codebases for vulnerabilities, secret leaks, and misconfigurations.

Community
Advanced
elbrunoelbruno
2

release-process

Validates, publishes, and verifies npm package releases through pre-release checks and post-publish smoke tests.

Community
Advanced