Check Npm
Grafana LabsOfficialPublished by Grafana Labs
- Skill
- Review and audit
- Software development
- Apache-2.0
- Low risk
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill performs a read-only audit of a JavaScript or TypeScript project's package manager configuration. It checks for specific security-related settings including tool versions, lifecycle script execution policies, dependency protocol restrictions, and minimum release age requirements for dependencies. The audit provides a status report and suggests configuration fixes for any identified gaps.
What it does
- Detects the active package manager (npm, yarn, or pnpm) in the workspace root.
- Verifies that the package manager version meets minimum security thresholds.
- Checks for configurations that disable lifecycle scripts to prevent unauthorized code execution.
- Identifies unsafe dependency protocols such as git URLs or local file paths.
- Validates that minimum release age settings are configured to mitigate supply-chain risks.
- Generates a status report with paste-ready configuration snippets for any failed checks.
When to use it
- When auditing a project for supply-chain hardening best practices.
- When verifying if a project's package manager configuration blocks unsafe dependency sources.
- When checking if lifecycle scripts are properly disabled in a JS/TS repository.
- When ensuring that dependency release age gates are active.
Advantages
- Provides automated, consistent security checks across different package managers.
- Offers actionable, copy-pasteable configuration fixes for identified issues.
- Operates in a read-only mode to ensure project files remain unmodified.
- Standardizes security posture for npm, yarn, and pnpm environments.
Usage examples
- “/check-npm”
- The agent scans the current directory, identifies the package manager, checks the configuration against security thresholds, and outputs a table detailing the status of each check with recommended fixes for any failures.
- “Audit my project's package manager security settings.”
- The agent performs a full audit of the workspace root, evaluating tool versions, script execution policies, and dependency protocols, then provides a summary report.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/grafana/check-npm/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip check-npm.zip -d .agents/skills
Documentation by Grafana Labs
npm / yarn / pnpm supply-chain audit
Read-only audit of the workspace root. Do not modify any files.
0. Detect package manager
test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || trueIf no package.json, stop. Priority: packageManager → lockfile → default npm.
1. Tool version
npm --version # required ≥ 11.15.0
yarn --version # required ≥ 4.14.0
pnpm --version # required ≥ 11.0.0Use semver comparison. Verify pinned packageManager meets threshold.
| Manager | Minimum |
|---|---|
| npm | 11.15.0 |
| yarn | 4.14.0 |
| pnpm | 11.0.0 |
2. Lifecycle scripts disabled
grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null| Manager | PASS | FAIL |
|---|---|---|
| npm | .npmrc has ignore-scripts=true | missing or false |
| yarn | enableScripts: false or key absent | enableScripts: true |
| pnpm ≥ 11 | strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/[] | strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty |
| pnpm 10 | .npmrc ignore-scripts=true OR strictDepBuilds: true | neither |
pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md.
3. Unsafe dependency protocols
Registry:
grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/nullScan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md, then scan only those manifests. Fallback (may overmatch non-workspace manifests):
find . -name package.json -not -path '*/node_modules/*'Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).
| Manager | PASS | FAIL |
|---|---|---|
| npm | allow-git=none or root | missing or all |
| yarn | approvedGitRepositories: [] or grafana-scoped list, or omitted with policy comment + clean scan | unsafe entries or broad allow-list |
| pnpm ≥ 11 | blockExoticSubdeps unset/true | false |
| pnpm 10.x | blockExoticSubdeps: true | unset (default false) or false |
Protocol detection order and yarn posture details: references/protocols.md.
4. Minimum release age ≥ 3 days
3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.
grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null| Manager | PASS | FAIL |
|---|---|---|
| npm | min-release-age ≥ 3 | missing |
| yarn | npmMinimalAgeGate ≥ 4320 min | missing or below |
| pnpm ≥ 11 | minimumReleaseAge ≥ 4320 | unset (default 1440) or below |
| pnpm 10 | minimum-release-age / minimumReleaseAge ≥ 4320 | missing |
Flag minimumReleaseAgeStrict: false on pnpm 11.
5. Report
| # | Check | Status | Detail |
|---|---|---|---|
| 0 | Package manager | (npm / yarn / pnpm) | version: x.y.z (pinned: y.y.y if set) |
| 1 | Tool version ≥ threshold | PASS / FAIL | actual vs required |
| 2 | Scripts disabled | PASS / FAIL | config line or "missing" |
| 3 | Unsafe dep protocols | PASS / FAIL | registry state + flagged entries |
| 4 | Min release age ≥ 3 days | PASS / FAIL | config + value |
Use PASS / FAIL only — no emojis.
For each FAIL, one paste-ready fix:
# npm — .npmrc
ignore-scripts=true
allow-git=none
min-release-age=3# pnpm 11 — pnpm-workspace.yaml
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds: []
minimumReleaseAge: 4320
blockExoticSubdeps: true# yarn — .yarnrc.yml
npmMinimalAgeGate: 4320More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md.
If all PASS: "All checks passed." and stop.
Files
- ATTRIBUTION.mdAdded by AutoGineer841 B
- LICENSELicence file added by AutoGineer11.1 KiB
- SKILL.md5.1 KiB
- references/fix-snippets.md1.1 KiB
- references/managers.md3.4 KiB
- references/protocols.md1.1 KiB
SKILL.md
npm / yarn / pnpm supply-chain audit
Read-only audit of the workspace root. Do not modify any files.
0. Detect package manager
test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || trueIf no package.json, stop. Priority: packageManager → lockfile → default npm.
1. Tool version
npm --version # required ≥ 11.15.0
yarn --version # required ≥ 4.14.0
pnpm --version # required ≥ 11.0.0Use semver comparison. Verify pinned packageManager meets threshold.
| Manager | Minimum |
|---|---|
| npm | 11.15.0 |
| yarn | 4.14.0 |
| pnpm | 11.0.0 |
2. Lifecycle scripts disabled
grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null| Manager | PASS | FAIL |
|---|---|---|
| npm | .npmrc has ignore-scripts=true | missing or false |
| yarn | enableScripts: false or key absent | enableScripts: true |
| pnpm ≥ 11 | strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/[] | strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty |
| pnpm 10 | .npmrc ignore-scripts=true OR strictDepBuilds: true | neither |
pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md.
3. Unsafe dependency protocols
Registry:
grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/nullScan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md, then scan only those manifests. Fallback (may overmatch non-workspace manifests):
find . -name package.json -not -path '*/node_modules/*'Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).
| Manager | PASS | FAIL |
|---|---|---|
| npm | allow-git=none or root | missing or all |
| yarn | approvedGitRepositories: [] or grafana-scoped list, or omitted with policy comment + clean scan | unsafe entries or broad allow-list |
| pnpm ≥ 11 | blockExoticSubdeps unset/true | false |
| pnpm 10.x | blockExoticSubdeps: true | unset (default false) or false |
Protocol detection order and yarn posture details: references/protocols.md.
4. Minimum release age ≥ 3 days
3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.
grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null| Manager | PASS | FAIL |
|---|---|---|
| npm | min-release-age ≥ 3 | missing |
| yarn | npmMinimalAgeGate ≥ 4320 min | missing or below |
| pnpm ≥ 11 | minimumReleaseAge ≥ 4320 | unset (default 1440) or below |
| pnpm 10 | minimum-release-age / minimumReleaseAge ≥ 4320 | missing |
Flag minimumReleaseAgeStrict: false on pnpm 11.
5. Report
| # | Check | Status | Detail |
|---|---|---|---|
| 0 | Package manager | (npm / yarn / pnpm) | version: x.y.z (pinned: y.y.y if set) |
| 1 | Tool version ≥ threshold | PASS / FAIL | actual vs required |
| 2 | Scripts disabled | PASS / FAIL | config line or "missing" |
| 3 | Unsafe dep protocols | PASS / FAIL | registry state + flagged entries |
| 4 | Min release age ≥ 3 days | PASS / FAIL | config + value |
Use PASS / FAIL only — no emojis.
For each FAIL, one paste-ready fix:
# npm — .npmrc
ignore-scripts=true
allow-git=none
min-release-age=3# pnpm 11 — pnpm-workspace.yaml
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds: []
minimumReleaseAge: 4320
blockExoticSubdeps: true# yarn — .yarnrc.yml
npmMinimalAgeGate: 4320More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md.
If all PASS: "All checks passed." and stop.
Requirements and compatibility
Written for: Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter, Needs Node.js
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Grafana Labs
- Publisher
- Grafana Labs (Official)
- Source
- grafana/skills · skills/grafana-plugins/check-npm · commit 8fb72a5
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Grafana Labs or Grafana Labs.
Related skills
Migrate To Shoehorn
Matt Pocock· Community
Automate the migration of TypeScript test assertions from unsafe as-casting to the type-safe shoehorn library.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository317.5k
Tdd
Matt Pocock· Community
A reference guide for implementing the red-green-refactor loop in test-driven development.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository317.5k
Test Driven Development
Jesse Vincent (obra)· Community
A rigorous framework for Test-Driven Development, mandating that failing tests precede all production code.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository314k
Webapp Testing
AnthropicOfficial
A toolkit for automating local web application testing using Playwright and server management helpers.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreApache-2.0Low riskHas scriptsGitHub stars of the source repository188.6k
Test Driven Development
Addy Osmani· Community
A systematic approach to software development using the red-green-refactor cycle to ensure code reliability and maintainability.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository113.9k
Browser Testing With Devtools
Addy Osmani· Community
Integrate Chrome DevTools to enable live browser inspection, debugging, and automated UI verification for your AI agent.
Software developmentClaude CodeClaude appsOpenAI Codex+14 moreMITGitHub stars of the source repository113.9k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download check-npm.zip