skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-npm-security

Review npm security posture against OWASP guidance with evidence-based findings.

Updated Mar 26, 2026
Search Tags:#npm#owasp#security review#ci-cd#supply chain#privilege#dependency risk
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-npm-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-npm-security
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-npm-security
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-npm-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps reviewers identify npm-related security weaknesses that can expand attacker reach through unsafe defaults, weak isolation, exposed management surfaces, and compromised dependencies.

Core Features & Use Cases

  • Runtime and Privilege Review: Examines service accounts, process privileges, admin access, and other trust boundaries that can amplify impact.
  • Dependency and Deployment Analysis: Checks package trust, pinning, provenance, configuration hardening, and CI/CD release paths for supply-chain risk.
  • Use Case: Use it when reviewing an application, platform, or deployment pipeline to confirm that npm-related controls are enforced consistently across local, staging, and production environments.

Quick Start

Ask Copilot to review the npm security posture of this repository and focus on the relevant package, runtime, deployment, and dependency trust boundaries.

Frequently Asked Questions about security-review-owasp-npm-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review npm security posture against OWASP guidance?▼

Review npm security posture against OWASP guidance by examining package trust, runtime privileges, and CI/CD deployment paths to produce evidence-based findings and severity-ordered remediation for vulnerabilities.

What is npm supply chain risk and how does it affect deployment?▼

Npm supply chain risk is the exposure to compromised dependencies and unsafe defaults that expand attacker reach through weak isolation and exposed management surfaces during deployment.

How do I check npm dependency trust and provenance in a CI/CD pipeline?▼

Check npm dependency trust and provenance in a CI/CD pipeline by reviewing package pinning, configuration hardening, and release paths to identify supply-chain risks and enforce consistent controls across environments.

Does this OWASP security review cover runtime privileges and service accounts?▼

Yes, the OWASP security review covers runtime and privilege review by examining service accounts, process privileges, admin access, and trust boundaries to identify configurations that can amplify attacker impact.

What is the best way to harden npm trust boundaries for container deployments?▼

Harden npm trust boundaries for container deployments by reviewing package manifests, configuration hardening, and deployment assumptions against OWASP guidance to produce severity-ordered remediation for code and configuration gaps.

Related Skills

Explore More Software Engineering Skills→
shakhovskiya-createshakhovskiya-create

deploy-audit

Audit CI/CD pipelines and infrastructure configurations for security and reliability.

Community
Advanced
47network47network
5

dependency-audit

Audit Node.js dependencies for CVEs, licensing, typosquatting, and supply-chain risks.

Community
Intermediate
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
Muath2000Muath2000

supply-chain-analyst

Analyze software supply chain risks and generate SBOMs.

Community
Advanced