skills.rest
saleor
saleorOFFICIAL
Explore all skills by this author →
Website𝕏@getsaleorGitHub

saleor-dashboard-security-audit

Triage OSV and pnpm audit findings into batched dependency vulnerability fixes.

1.0k|1.2k|Updated Jun 19, 2019
Search Tags:#pnpm#osv-scanner#vulnerability triage#cve remediation#Security audit#socket firewall#dependency overrides
One-click install
npx skills add https://github.com/saleor/saleor-dashboard --skill saleor-dashboard-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: saleor-dashboard-security-audit
Source: https://github.com/saleor/saleor-dashboard/tree/main/.claude/skills/saleor-dashboard-security-audit
Command: npx skills add https://github.com/saleor/saleor-dashboard --skill saleor-dashboard-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dependency security audits produce long, noisy lists of vulnerabilities, and fixing them all at once creates risky, unreviewable changes. This Skill turns OSV-Scanner and pnpm audit output into small, prioritized, independently mergeable fix batches that respect the repository's override and release-age policies.

Core Features & Use Cases

  • Dual-scanner triage: Runs OSV-Scanner against pnpm-lock.yaml and merges results with pnpm audit advisories, deduplicating by ID and aliases.
  • Policy-aware fixes: Pins transitive dependencies via pnpm-workspace.yaml overrides, respects the 21-day minimumReleaseAge gate, and checks auditConfig.ignoreCves before proposing fixes.
  • Batched proposals: Groups findings by severity and dependency family into accept-first batches (criticals, direct bumps, transitive overrides, deferred items) that are only applied after user approval, with installs wrapped in Socket Firewall.
  • Use Case: After a CI security scan flags 30 vulnerabilities, use this Skill to get a prioritized report of 4-5 mergeable batches, each with exact pnpm-workspace.yaml edits, age-gate status, and verification steps.

Quick Start

Run a security audit on this repository and propose batched fixes for the vulnerabilities you find.

Frequently Asked Questions about saleor-dashboard-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix pnpm audit vulnerabilities in a monorepo?▼

Run OSV-Scanner against pnpm-lock.yaml and pnpm audit, then pin transitive dependencies via the overrides section in pnpm-workspace.yaml rather than bumping each one. Direct dependencies are bumped in package.json, and fixes are applied in small severity-ordered batches.

How to triage OSV-Scanner results with pnpm audit output?▼

Parse the OSV JSON first, merging records by id and aliases, then join pnpm findings by package and installed version. The pnpm dependency path reveals whether a finding is direct or transitive, which determines whether to edit package.json or overrides.

Why does pnpm reject a newly released patched version?▼

The minimumReleaseAge setting in pnpm-workspace.yaml blocks packages published less than 21 days ago. Prefer the oldest age-compliant patched version, or add the package to minimumReleaseAgeExclude only when severity justifies bypassing the gate.

Should transitive dependencies be bumped individually?▼

No. Transitive vulnerabilities are pinned through pnpm-workspace.yaml overrides, which is the single source of truth, rather than package.json pnpm.overrides. One override often clears many advisories across multiple dependency paths.

What is Socket Firewall and why wrap pnpm install with it?▼

Socket Firewall (sfw) scans dependencies in real time and blocks known-malicious packages before they reach disk during installation. Wrapping installs as sfw pnpm install protects the exact moment compromised packages would land on the machine.

Related Skills

Explore More Software Engineering Skills→
igbuendigbuend
8

osv-scanner

Scan project dependencies for known vulnerabilities using Google OSV-Scanner.

Community
Intermediate
j4hr3nj4hr3n

fix-grype-tf

Auto-fix Grype scan vulnerabilities by updating dependencies and opening PRs.

Community
Advanced
dengineproblemdengineproblem

cve-tracking-system

Track CVEs via NVD API and calculate CVSS scores for patch prioritization.

Community
Advanced
Soyio-idSoyio-id

prepare-security-prs

Triage dependency bot pull requests and prepare safe merge actions.

Official
Advanced