check-npm
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. Use this skill to enforce hardening best practices and maintain a resilient software supply chain.
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. The skill audits npm/yarn/pnpm configuration for supply-chain security hardening, verifying that lifecycle scripts are disabled and safe dependency protocols are enforced.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. The skill audits npm/yarn/pnpm configuration for supply-chain security hardening, verifying that lifecycle scripts are disabled and safe dependency protocols are enforced.
Use it when
- check-npm validates minimum release age and git dependency restrictions as part of its supply-chain hardening process.
- Yes, check-npm specifically verifies that lifecycle scripts are disabled and safe dependency protocols are enforced across your npm, yarn.
Verify before relying
Read SKILL.md below before installing (4 files). Open directory: indexed for reading, not audited.
Install
grafana/skills/check-npm · repository language: JavaScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does check-npm audit in terms of npm package manager security?
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. The skill audits npm/yarn/pnpm configuration for supply-chain security hardening, verifying that lifecycle scripts are disabled and safe dependency protocols are enforced.
How does check-npm verify that git dependencies are blocked?
check-npm validates minimum release age and git dependency restrictions as part of its supply-chain hardening process. The skill scans your package manager configuration to ensure that git dependencies are properly restricted or blocked, preventing the installation of unvetted code directly from repositories. This check is critical for maintaining control over your dependency sources and reducing exposure to untrusted or unaudited packages.
Can check-npm verify that lifecycle scripts are disabled in npm configuration?
Yes, check-npm specifically verifies that lifecycle scripts are disabled and safe dependency protocols are enforced across your npm, yarn, and pnpm setup. By checking your package manager's ignore-scripts configuration and related hardening settings, check-npm ensures that potentially dangerous automated scripts cannot execute during package installation, significantly reducing your attack surface during the dependency installation process.
What package manager versions does check-npm require to meet security thresholds?
check-npm checks that your package manager version meets minimum security thresholds as part of its comprehensive audit. The skill validates that npm, yarn, or pnpm versions in use are sufficiently recent to include important security patches and hardening features. This ensures your toolchain itself is not a weak link in your supply-chain defense strategy.
How can check-npm help generate compliance fixes for package manager security policies?
check-npm can generate compliance fixes for package manager security policies, helping you remediate identified misconfigurations automatically. After surfacing issues like unsafe protocols, disabled hardening options, or outdated package manager versions, the skill provides actionable recommendations to harden your npm, yarn, or pnpm setup and align your configuration with supply-chain security best practices.
Does check-npm scan for exotic subdependencies and unsafe protocols in package.json?
Yes, check-npm scans your package.json and related configuration for unsafe protocols and exotic subdependencies that could pose supply-chain risks. The skill analyzes your dependency declarations to identify patterns that bypass standard security controls, helping you maintain a resilient software supply chain by enforcing hardening best practices across npm, yarn, and pnpm configurations.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
npm / yarn / pnpm supply-chain audit
Read-only audit of the workspace root. Do not modify any files.
0. Detect package manager
test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true
If no package.json, stop. Priority: packageManager → lockfile → default npm.
1. Tool version
npm --version # required ≥ 11.15.0
yarn --version # required ≥ 4.14.0
pnpm --version # required ≥ 11.0.0
Use semver comparison. Verify pinned packageManager meets
(truncated - see the full file via the links below)
File tree — 4 files
skills/grafana-plugins/check-npm/SKILL.md
skills/grafana-plugins/check-npm/references/fix-snippets.md
skills/grafana-plugins/check-npm/references/managers.md
skills/grafana-plugins/check-npm/references/protocols.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Audit npm/yarn/pnpm configuration for supply-chain security hardening”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill equips developers with essential security practices for npm-based projects, covering dependency vetting, vulnerability detection, and safe package management workflows. Gain actionable guidance on hardening your supply chain and mitigating common risks in the Node.js ecosystem.
This skill helps you streamline your pnpm project's dependency tree by identifying and removing unnecessary packages that bloat your lockfile. It provides automated auditing capabilities to surface redundant or unused dependencies, enabling you to maintain a leaner, faster build environment with minimal manual effort.
This skill automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently.
This skill automates the process of updating project dependencies, reducing the overhead of manual version management and compatibility checks. By integrating with your development workflow, it helps teams stay current with the latest package versions while maintaining stability and reducing technical debt.
This skill helps SAP developers detect and fix security weaknesses lurking in their project dependencies. By scanning your packages against known vulnerability databases, you can address supply chain risks before they reach production and keep your SAP applications hardened against emerging threats.
This skill teaches you how to build and manage pnpm workspaces, enabling efficient monorepo development across multiple interconnected packages. You'll master workspace configuration, dependency management, and best practices for scaling projects with pnpm's lightweight approach.
More skills pnpm (Apache-2.0) · pnpm (MIT) · supply-chain-hardening (MIT) · Update Harness Dependencies (NOASSERTION) · npm-helper (MIT) · pnpm (MIT) · pnpm (MIT)