AutoGineer
Generated banner for Check Npm
Generated logo for Check Npm

Check Npm

Grafana LabsOfficialPublished by Grafana Labs

  • Skill
  • Review and audit
  • Software development
  • Apache-2.0
  • Low risk
Download ZIP

From the author

Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
— the description by Grafana Labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill performs a read-only audit of a JavaScript or TypeScript project's package manager configuration. It checks for specific security-related settings including tool versions, lifecycle script execution policies, dependency protocol restrictions, and minimum release age requirements for dependencies. The audit provides a status report and suggests configuration fixes for any identified gaps.

What it does

  • Detects the active package manager (npm, yarn, or pnpm) in the workspace root.
  • Verifies that the package manager version meets minimum security thresholds.
  • Checks for configurations that disable lifecycle scripts to prevent unauthorized code execution.
  • Identifies unsafe dependency protocols such as git URLs or local file paths.
  • Validates that minimum release age settings are configured to mitigate supply-chain risks.
  • Generates a status report with paste-ready configuration snippets for any failed checks.

When to use it

  • When auditing a project for supply-chain hardening best practices.
  • When verifying if a project's package manager configuration blocks unsafe dependency sources.
  • When checking if lifecycle scripts are properly disabled in a JS/TS repository.
  • When ensuring that dependency release age gates are active.

Advantages

  • Provides automated, consistent security checks across different package managers.
  • Offers actionable, copy-pasteable configuration fixes for identified issues.
  • Operates in a read-only mode to ensure project files remain unmodified.
  • Standardizes security posture for npm, yarn, and pnpm environments.

Usage examples

“/check-npm”
The agent scans the current directory, identifies the package manager, checks the configuration against security thresholds, and outputs a table detailing the status of each check with recommended fixes for any failures.
“Audit my project's package manager security settings.”
The agent performs a full audit of the workspace root, evaluating tool versions, script execution policies, and dependency protocols, then provides a summary report.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/grafana/check-npm/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip check-npm.zip -d .agents/skills

Documentation by Grafana Labs

npm / yarn / pnpm supply-chain audit

Read-only audit of the workspace root. Do not modify any files.

0. Detect package manager

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

If no package.json, stop. Priority: packageManager → lockfile → default npm.

1. Tool version

npm --version    # required ≥ 11.15.0
yarn --version   # required ≥ 4.14.0
pnpm --version   # required ≥ 11.0.0

Use semver comparison. Verify pinned packageManager meets threshold.

ManagerMinimum
npm11.15.0
yarn4.14.0
pnpm11.0.0

2. Lifecycle scripts disabled

grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null
ManagerPASSFAIL
npm.npmrc has ignore-scripts=truemissing or false
yarnenableScripts: false or key absentenableScripts: true
pnpm ≥ 11strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/[]strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty
pnpm 10.npmrc ignore-scripts=true OR strictDepBuilds: trueneither

pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md.

3. Unsafe dependency protocols

Registry:

grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

Scan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md, then scan only those manifests. Fallback (may overmatch non-workspace manifests):

find . -name package.json -not -path '*/node_modules/*'

Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).

ManagerPASSFAIL
npmallow-git=none or rootmissing or all
yarnapprovedGitRepositories: [] or grafana-scoped list, or omitted with policy comment + clean scanunsafe entries or broad allow-list
pnpm ≥ 11blockExoticSubdeps unset/truefalse
pnpm 10.xblockExoticSubdeps: trueunset (default false) or false

Protocol detection order and yarn posture details: references/protocols.md.

4. Minimum release age ≥ 3 days

3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null
ManagerPASSFAIL
npmmin-release-age ≥ 3missing
yarnnpmMinimalAgeGate ≥ 4320 minmissing or below
pnpm ≥ 11minimumReleaseAge ≥ 4320unset (default 1440) or below
pnpm 10minimum-release-age / minimumReleaseAge ≥ 4320missing

Flag minimumReleaseAgeStrict: false on pnpm 11.

5. Report

#CheckStatusDetail
0Package manager(npm / yarn / pnpm)version: x.y.z (pinned: y.y.y if set)
1Tool version ≥ thresholdPASS / FAILactual vs required
2Scripts disabledPASS / FAILconfig line or "missing"
3Unsafe dep protocolsPASS / FAILregistry state + flagged entries
4Min release age ≥ 3 daysPASS / FAILconfig + value

Use PASS / FAIL only — no emojis.

For each FAIL, one paste-ready fix:

# npm — .npmrc
ignore-scripts=true
allow-git=none
min-release-age=3
# pnpm 11 — pnpm-workspace.yaml
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds: []
minimumReleaseAge: 4320
blockExoticSubdeps: true
# yarn — .yarnrc.yml
npmMinimalAgeGate: 4320

More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md.

If all PASS: "All checks passed." and stop.

Files

ATTRIBUTION.md

Attribution

This folder is an unmodified copy of the Agent Skill "check-npm", distributed by AutoGineer (https://autogineer.com/agent-skills).

The skill's own files are unmodified copies. AutoGineer is not affiliated with or endorsed by the author or the publisher.

Files added by AutoGineer

  • ATTRIBUTION.md: this file, written by AutoGineer

  • LICENSE: copied from LICENSE

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs Node.js

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Grafana Labs
Publisher
Grafana Labs (Official)
Source
grafana/skills · skills/grafana-plugins/check-npm · commit 8fb72a5
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Grafana Labs or Grafana Labs.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download check-npm.zip