skills.rest
lgerard314
lgerard314OFFICIAL
Explore all skills by this author →
GitHub

supply-chain-and-dependencies

Enforce pnpm dependency audits, lockfile integrity, and license checks in CI.

Updated Aug 27, 2026
Search Tags:#security#audit#compliance#license#pnpm#dependency#lockfile
One-click install
npx skills add https://github.com/lgerard314/global-plugin --skill supply-chain-and-dependencies
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-and-dependencies
Source: https://github.com/lgerard314/global-plugin/tree/main/plugin/skills/supply-chain-and-dependencies
Command: npx skills add https://github.com/lgerard314/global-plugin --skill supply-chain-and-dependencies

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams enforce deterministic dependency management by protecting lockfile integrity, scanning for supply-chain risks, and enforcing license policies across CI and PR workflows.

Core Features & Use Cases

  • Lockfile discipline: ensure a committed lockfile is used in CI to avoid drift.
  • SCA and license policy: require regular dependency audits and license checks before merges.
  • Dependency evaluation: assess new direct dependencies for risk and alternatives.
  • Typosquat prevention: detect risky misnamed packages during dependency updates.

Quick Start

Review a project’s dependencies and enforce policy on every PR.

Frequently Asked Questions about supply-chain-and-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce lockfile discipline and prevent dependency drift in CI?▼

Lockfile discipline is enforced by requiring a committed lockfile in CI, ensuring deterministic installs and preventing dependency drift across pnpm-based ecosystems.

How do I prevent typosquatting and insecure upgrades in pnpm dependencies?▼

Typosquatting and insecure upgrades are prevented by enabling automated pnpm audit in CI and evaluating new direct dependencies for supply-chain risks before merges.

Can I use this to check license compliance for npm package dependencies?▼

License compliance for dependencies is supported through explicit license checks applied to PR workflows, preventing unlicensed packages from being merged into the project.

What's the best way to automate supply-chain security audits on pull requests?▼

Automating supply-chain security audits on PRs is best handled by enforcing policy-driven guardrails that scan lockfiles, detect typosquats, and run pnpm audit in CI.

Does pnpm audit in CI require a committed lockfile to secure the supply chain?▼

Yes, a committed lockfile is required to secure the supply chain, as it ensures deterministic resolution and prevents drift when running automated pnpm audit checks in CI.

Why should I assess new direct dependencies for risk and alternatives?▼

Assessing new direct dependencies for risk and alternatives helps evaluate supply-chain threats, detect typosquats, and enforce license policy before introducing packages into the project.

Related Skills

Explore More Software Engineering Skills→
peterWang123589peterWang123589

pnpm

Manage Node.js monorepo dependencies with pnpm workspaces and catalogs.

Community
Intermediate
luissimon96luissimon96

graph-dependency

Audit dependencies, generate SBOMs, and check license compliance for software projects.

Community
Advanced
joseph-c-mcguirejoseph-c-mcguire
1

06-tech-tooling

Set up and validate linters, formatters, and test runners for CI builds.

Community
Advanced
NOMARJNOMARJ
5

supply-chain-audit

Audit project dependencies for supply-chain threats and classify findings by severity.

Official
Intermediate