57 skills · sorted by relevance
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.
Package management discipline for any JavaScript/TypeScript project: dependency declaration, semver, scripts conventions, lockfile hygiene, package-manager detection (npm/yarn/pnpm). Stack-agnostic — referenced by every JS/TS framework plugin in the marketplace. Use this skill to: - Add a dependency correctly (right field, right semver range). - Pick the project's package manager from lockfile. - Define `scripts` entries that match conventions. - Avoid lockfile mistakes (manual edits, wrong commits). Do NOT use this skill for: - Code-level conventions (see the active framework plugin's conventions skill). - Framework-specific package patterns (NestJS modules, Angular schematics, Expo SDK choice etc.).
The English summary is being prepared. Showing the original description.
Audit project dependencies for known vulnerabilities and outdated packages. Organize findings by severity, review proposed package changes before optional automatic fixes, and rerun the audit to check whether the reported vulnerability count decreased.
Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.
Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.
The English summary is being prepared. Showing the original description.
Python dependency management with Poetry and Rye -- lockfile-driven workflows, dependency groups, monorepo patterns, and migration paths. Covers pyproject.toml-centric packaging for projects not yet on uv.
The English summary is being prepared. Showing the original description.
用于规划、实现或审查前端依赖升级、包迁移、lockfile 变更、框架大版本升级、CVE 修复、peer dependency 冲突、ESM/CJS 切换、构建工具兼容性或 CI 验证矩阵；中文触发词包括 依赖升级、版本升级、lockfile、peer dependency、CVE 修复、大版本迁移。
The English summary is being prepared. Showing the original description.
Use when planning, implementing, or reviewing frontend dependency upgrades, package migrations, lockfile changes, major framework version bumps, CVE remediation, peer dependency conflicts, ESM/CJS shifts, build-tool compatibility, or CI verification matrices; Chinese triggers include dependency upgrades, version upgrades, lockfile, peer dependency, CVE fixes, major version migrations.
The English summary is being prepared. Showing the original description.
Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.
The English summary is being prepared. Showing the original description.
Operational guide for the NV oOS Dependabot alert triage-and-remediation loop: querying open alerts via gh api, separating stale from genuinely vulnerable lockfile entries (default-branch forensics), deciding between safe in-major override bumps, scoped overrides, or deferred major migrations (npm pack signature diffing), regenerating the 13-lockfile tree, dismissing alerts with the right reason, GitHub issue housekeeping, and triaging the known CI failure modes. Use when asked to fix dependabot alerts, close out dependabot issues, bump vulnerable npm packages, or resume a dependabot session.
The English summary is being prepared. Showing the original description.
dependabot 設定（.github/dependabot.yml）の新規作成・整備。リポジトリから ecosystem を自動検出し、lockfile コンフリクトを避ける group 設計と security fast-track を備えた設定を生成する。dependabot 設定の作成・見直し・追加の依頼時、/setup-dependabot 実行時に使用。境界: Renovate は対象外。dependabot が作った PR の対応は pr-review 等の通常フロー。
The English summary is being prepared. Showing the original description.
Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.
The English summary is being prepared. Showing the original description.
Review code changes before merging across correctness, readability, architecture, security, and performance. Get findings that distinguish required fixes from optional suggestions, with concrete ways to simplify code and checks on test coverage.
Update Remotion’s FFmpeg dependency to a published rust-ffmpeg commit, refresh the dependency lockfile, and rebuild compositor binaries for all supported platforms. Validate the changes and open a draft pull request with source revisions and build results.
Update Remotion and its related packages while respecting the project's package manager and workspace structure. The workflow aligns package versions, updates the lockfile and installed Remotion skills, and checks the resulting dependency changes.
Transfer selected Chatbox Pro commits into the open source edition using cherry-picking, which copies individual changes. The skill handles excluded files, package names, dependency conflicts, lockfile regeneration, and version tags for manual releases.
Set up Python projects with uv, manage required packages, and create isolated environments for each project. Covers Python versions, dependency updates, migration from existing tools, and lockfiles that record package versions for repeatable installations.
Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.
Prepare Python SDK releases by updating versions, package metadata, pinned dependencies, lockfiles, and build workflows. The skill covers release process changes and publication verification, helping agents handle packaging work within the repository’s release procedures.
Publish a Playground UI snapshot, a version for testing branch changes, through the npm release workflow. The skill checks publication results, updates the platform frontend's package versions and lockfile, and opens a pull request.
Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
The English summary is being prepared. Showing the original description.
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
The English summary is being prepared. Showing the original description.