check-npm
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. Use this skill to enforce hardening best practices and maintain a resilient software supply chain.
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. The skill audits npm/yarn/pnpm configuration for supply-chain security hardening, verifying that lifecycle scripts are disabled and safe dependency protocols are enforced.
AI-generated summary based on this skill's SKILL.md
Install
grafana/skills/check-npm · repository language: JavaScript
git clone https://github.com/grafana/skills
cp -r skills/skills/grafana-plugins/check-npm ~/.claude/skills/check-npmFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does check-npm audit in terms of npm package manager security?
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. The skill audits npm/yarn/pnpm configuration for supply-chain security hardening, verifying that lifecycle scripts are disabled and safe dependency protocols are enforced.
How does check-npm verify that git dependencies are blocked?
check-npm validates minimum release age and git dependency restrictions as part of its supply-chain hardening process. The skill scans your package manager configuration to ensure that git dependencies are properly restricted or blocked, preventing the installation of unvetted code directly from repositories. This check is critical for maintaining control over your dependency sources and reducing exposure to untrusted or unaudited packages.
Can check-npm verify that lifecycle scripts are disabled in npm configuration?
Yes, check-npm specifically verifies that lifecycle scripts are disabled and safe dependency protocols are enforced across your npm, yarn, and pnpm setup. By checking your package manager's ignore-scripts configuration and related hardening settings, check-npm ensures that potentially dangerous automated scripts cannot execute during package installation, significantly reducing your attack surface during the dependency installation process.
What package manager versions does check-npm require to meet security thresholds?
check-npm checks that your package manager version meets minimum security thresholds as part of its comprehensive audit. The skill validates that npm, yarn, or pnpm versions in use are sufficiently recent to include important security patches and hardening features. This ensures your toolchain itself is not a weak link in your supply-chain defense strategy.
How can check-npm help generate compliance fixes for package manager security policies?
check-npm can generate compliance fixes for package manager security policies, helping you remediate identified misconfigurations automatically. After surfacing issues like unsafe protocols, disabled hardening options, or outdated package manager versions, the skill provides actionable recommendations to harden your npm, yarn, or pnpm setup and align your configuration with supply-chain security best practices.
Does check-npm scan for exotic subdependencies and unsafe protocols in package.json?
Yes, check-npm scans your package.json and related configuration for unsafe protocols and exotic subdependencies that could pose supply-chain risks. The skill analyzes your dependency declarations to identify patterns that bypass standard security controls, helping you maintain a resilient software supply chain by enforcing hardening best practices across npm, yarn, and pnpm configurations.
SKILL.md
rendered from the published skill — quoted content, verbatim
npm / yarn / pnpm supply-chain audit
Read-only audit of the workspace root. Do not modify any files.
0. Detect package manager
test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true
If no package.json, stop. Priority: packageManager → lockfile → default npm.
1. Tool version
npm --version # required ≥ 11.15.0
yarn --version # required ≥ 4.14.0
pnpm --version # required ≥ 11.0.0
Use semver comparison. Verify pinned packageManager meets
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 4 files
skills/grafana-plugins/check-npm/SKILL.md
skills/grafana-plugins/check-npm/references/fix-snippets.md
skills/grafana-plugins/check-npm/references/managers.md
skills/grafana-plugins/check-npm/references/protocols.md