skills.rest
mauriciodelrio
mauriciodelrioCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

install-dependencies-rules

Enforce pinned pnpm dependency versions with pnpm audit and OSV scanning.

3|Updated Apr 12, 2026
Search Tags:#pnpm#supply-chain-security#dependency-management#dependabot#pnpm-audit#osv-scanner
One-click install
npx skills add https://github.com/mauriciodelrio/delriodev-skills --skill install-dependencies-rules
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: install-dependencies-rules
Source: https://github.com/mauriciodelrio/delriodev-skills/tree/main/es-skills/software/install-dependencies-rules
Command: npx skills add https://github.com/mauriciodelrio/delriodev-skills --skill install-dependencies-rules

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Previene la introducción de versiones comprometidas o inesperadas en proyectos Node.js al imponer un flujo seguro y auditable para añadir, actualizar o eliminar dependencias, aplicable a frontend, backend y monorepos.

Core Features & Use Cases

  • Política de instalación estricta: obligación de usar pnpm, guardar versiones exactas (save-exact) y declarar packageManager/engines para coherencia entre dev y CI.
  • Auditoría y detección: comprobaciones inmediatas con pnpm audit y escaneos con OSV-Scanner, más integración de herramientas como Socket.dev para análisis de paquetes sospechosos.
  • Actualizaciones controladas: Dependabot configura PRs semanales y el pipeline CI exige frozen-lockfile y pasos de auditoría antes del merge.
  • Use Case: Al añadir una librería nueva, el desarrollador valida la versión con pnpm view, instala con versión fijada y ejecuta auditorías y escaneos antes de abrir PR.

Quick Start

Antes de instalar cualquier paquete, confirma la versión con pnpm view, instala con pnpm add <paquete>@<versión> asegurando save-exact=true, y ejecuta pnpm audit y osv-scanner inmediatamente después.

Frequently Asked Questions about install-dependencies-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce secure dependency installation in a Node.js monorepo using pnpm?▼

Secure dependency installation in a pnpm monorepo requires pinned exact versions, pnpm view checks before adding packages, and frozen-lockfile enforcement in CI to prevent unexpected or compromised versions.

What is the best way to automate dependency auditing for npm packages?▼

Automated dependency auditing is best achieved by running pnpm audit and OSV-Scanner in CI, combined with Dependabot for weekly update PRs, ensuring vulnerabilities are caught before merge.

Does this dependency management workflow work with frontend, backend, and monorepo setups?▼

Yes, this workflow applies to frontend, backend, and monorepo setups using pnpm, enforcing consistent packageManager and engines declarations across development and CI environments.

How do I safely add a new npm package to a project without introducing supply chain vulnerabilities?▼

To safely add an npm package, verify the target version with pnpm view, install it using pnpm add with save-exact enabled, and immediately execute pnpm audit and osv-scanner to detect threats.

Why should I use pnpm with save-exact for dependency management?▼

Using pnpm with save-exact pins exact dependency versions, preventing accidental upgrades to compromised releases and ensuring version coherence between local development and CI pipelines.

Can I integrate Socket.dev for scanning suspicious packages alongside pnpm audit?▼

Yes, you can integrate Socket.dev for analyzing suspicious packages alongside pnpm audit and osv-scanner to provide comprehensive supply-chain security during dependency installation.

Related Skills

Explore More Software Engineering Skills→
lsst-sqrelsst-sqre
2

docker-version-validation

Validate Dockerfile Node.js, pnpm, and turbo versions against package.json constraints.

Official
Intermediate
UiPathUiPath
18

fix-security-vulnerabilities

Trace transitive dependencies and apply validated fixes for npm and pnpm vulnerabilities.

Official
Advanced
xtrm-devxtrm-dev
4

security-pipeline

Bootstrap a GitHub security pipeline with secret scanning, SAST, and dependency checks.

Official
Advanced
syntropic137syntropic137

dependencies

Audit dependency configurations for lockfile pinning and SHA-pinned references.

Official
Advanced