Audit npm, pnpm, or bun dependency security and recommend fix commands.
npx skills add https://github.com/theodrosyimer/.dotfiles --skill npm-security
Please help me install this Agent Skill. Skill: npm-security Source: https://github.com/theodrosyimer/.dotfiles/tree/main/claude/skills/infra__npm-security Command: npx skills add https://github.com/theodrosyimer/.dotfiles --skill npm-security
Many JavaScript projects are vulnerable to supply chain attacks, unsafe install scripts, lockfile tampering, and insecure publishing practices. This Skill helps developers and maintainers discover those risks in their repository configuration and provides actionable remediation steps to reduce attack surface and secure CI/publishing pipelines.
Audit this project's npm security posture and return a pass/fail checklist with specific fix commands for each failing item.
High-intent search queries and answers about installing and using this skill.
To audit Node dependency security, run a project audit that inspects package.json, lockfiles, CI configs, and environment files to detect unsafe install scripts, lockfile tampering, and plaintext secrets while returning exact fix commands for each failing item.
Hardening npm publishing workflows involves reviewing publishing controls like provenance and OIDC, validating lockfile integrity, and suggesting CI integration steps for automated enforcement to secure your release pipelines against supply chain attacks.
Checking for unsafe postinstall scripts in pnpm or bun projects involves performing package manager detection and verifying postinstall script policies to flag blind upgrade scripts and reduce your repository's attack surface.
Yes, the dependency security audit works with monorepos and multiple package managers by detecting whether the project uses npm, pnpm, or bun, and then validating lockfile integrity and deterministic installs across the repository structure.
The best way to vet a new npm dependency before installation is to use a dual-mode reference mode that provides best-practice guidance on specific security topics, scans for plaintext secrets, and recommends security tooling like npq to ensure safe additions.
Lockfile validation in your CI pipeline is needed to ensure deterministic installs and prevent lockfile tampering, reducing the risk of supply chain attacks by verifying lockfile integrity during automated dependency checks.
LuohaothuConfigure project and global package manager preferences with detection fallback order.
nsuberiDiagnose GitHub Actions workflow failures using gh run logs and local reproduction commands.
buurgueesScan web projects for secrets, insecure configurations, dependency vulnerabilities, and weak authentication.
randalmurphalManage Python dependencies and resolve version conflicts across Poetry, Pip, and uv workflows.
