skills.rest
mattschaller
mattschallerCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

slopcheck

Scan Markdown and configuration files to verify npm package references against the live registry.

9|2|Updated Mar 8, 2026
Search Tags:#documentation#security#npm#cli#hallucination#slopsquatting
One-click install
npx skills add https://github.com/mattschaller/slopcheck --skill slopcheck
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: slopcheck
Source: https://github.com/mattschaller/slopcheck/tree/main
Command: npx skills add https://github.com/mattschaller/slopcheck --skill slopcheck

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Slopcheck helps teams prevent hallucinated npm package references from spreading into docs and skills by validating package names against the live registry before use.

Core Features & Use Cases

  • Scans Markdown and configuration files for install commands (npm, npx, yarn, pnpm, bun, bunx) and extracts package names.
  • Validates each package against the npm registry and flags not found, unpublished, or security-hold packages.
  • Useful for vetting AGENTS.md, SKILL.md, README.md, and other docs before deploying AI agents or automation pipelines.

Quick Start

Run npx slopcheck . to scan your project for phantom npm packages.

Frequently Asked Questions about slopcheck

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check Markdown docs for hallucinated or phantom npm packages?▼

To check Markdown docs for hallucinated npm packages, you can run a scanner that extracts install commands and validates package names against the live npm registry, flagging non-existent or unpublished packages.

What is slopsquatting and how does it affect AI agent skills?▼

Slopsquatting affects AI agent skills when hallucinated or non-existent npm package references in documentation are exploited by attackers publishing malicious packages under those names. Validating package references prevents this.

Can I scan configuration files for unpublished or security-hold npm packages?▼

Yes, you can scan configuration files for unpublished or security-hold npm packages by extracting install commands and checking each referenced package name against the live registry status.

Does slopcheck work with yarn, pnpm, and bun install commands?▼

Yes, slopcheck works with yarn, pnpm, bun, and bunx commands by scanning files for these install patterns, extracting the package names, and verifying them against the npm registry.

How do I verify npm package references in SKILL.md or AGENTS.md files?▼

To verify npm package references in SKILL.md or AGENTS.md files, scan the documents to extract package names from install commands and validate them against the npm registry to flag non-existent packages.

Related Skills

Explore More Software Engineering Skills→
Amar1404Amar1404
1

install-marp

Install Marp CLI globally and verify its version via npm.

Community
Basic
zhangzhang-111-izhangzhang-111-i
2

status

Analyze memory usage and flag stale references against health thresholds.

Community
Intermediate
hjemmesidekongenhjemmesidekongen
1

package-audit

Audit project dependencies for vulnerabilities, outdated packages, and license compliance.

Community
Advanced
hiddink-aihiddink-ai
1

hiddink-harness:analysis

Analyze project directories and dependency manifests to detect technology stacks.

Official
Advanced