supply-chain-and-dependencies

Name: supply-chain-and-dependencies
Availability: InStock
Author: lgerard314

Enforce pnpm dependency audits, lockfile integrity, and license checks in CI.

Updated Aug 27, 2026

Search Tags:#security #audit #compliance #license #pnpm #dependency #lockfile

Ready to run

npx skills add https://github.com/lgerard314/global-plugin --skill supply-chain-and-dependencies

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-and-dependencies
Source: https://github.com/lgerard314/global-plugin/tree/main/plugin/skills/supply-chain-and-dependencies
Command: npx skills add https://github.com/lgerard314/global-plugin --skill supply-chain-and-dependencies

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams enforce deterministic dependency management by protecting lockfile integrity, scanning for supply-chain risks, and enforcing license policies across CI and PR workflows.

Core Features & Use Cases

Lockfile discipline: ensure a committed lockfile is used in CI to avoid drift.
SCA and license policy: require regular dependency audits and license checks before merges.
Dependency evaluation: assess new direct dependencies for risk and alternatives.
Typosquat prevention: detect risky misnamed packages during dependency updates.

Quick Start

Review a project’s dependencies and enforce policy on every PR.

Frequently Asked Questions about supply-chain-and-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce lockfile discipline and prevent dependency drift in CI?▼

Lockfile discipline is enforced by requiring a committed lockfile in CI, ensuring deterministic installs and preventing dependency drift across pnpm-based ecosystems.

How do I prevent typosquatting and insecure upgrades in pnpm dependencies?▼

Typosquatting and insecure upgrades are prevented by enabling automated pnpm audit in CI and evaluating new direct dependencies for supply-chain risks before merges.

Can I use this to check license compliance for npm package dependencies?▼

License compliance for dependencies is supported through explicit license checks applied to PR workflows, preventing unlicensed packages from being merged into the project.

What's the best way to automate supply-chain security audits on pull requests?▼

Automating supply-chain security audits on PRs is best handled by enforcing policy-driven guardrails that scan lockfiles, detect typosquats, and run pnpm audit in CI.

Does pnpm audit in CI require a committed lockfile to secure the supply chain?▼

Yes, a committed lockfile is required to secure the supply chain, as it ensures deterministic resolution and prevents drift when running automated pnpm audit checks in CI.

Why should I assess new direct dependencies for risk and alternatives?▼

Assessing new direct dependencies for risk and alternatives helps evaluate supply-chain threats, detect typosquats, and enforce license policy before introducing packages into the project.