AutoGineer
Generated banner for Check Npm
Generated logo for Check Npm

Check Npm

Grafana LabsOfficialPublished by Grafana Labs

  • Skill
  • Review and audit
  • Software development
  • Apache-2.0
  • Low risk
Download ZIP

From the author

Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
— the description by Grafana Labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill performs a read-only audit of a JavaScript or TypeScript project's package manager configuration. It checks for specific security-related settings including tool versions, lifecycle script execution policies, dependency protocol restrictions, and minimum release age requirements for dependencies. The audit provides a status report and suggests configuration fixes for any identified gaps.

What it does

  • Detects the active package manager (npm, yarn, or pnpm) in the workspace root.
  • Verifies that the package manager version meets minimum security thresholds.
  • Checks for configurations that disable lifecycle scripts to prevent unauthorized code execution.
  • Identifies unsafe dependency protocols such as git URLs or local file paths.
  • Validates that minimum release age settings are configured to mitigate supply-chain risks.
  • Generates a status report with paste-ready configuration snippets for any failed checks.

When to use it

  • When auditing a project for supply-chain hardening best practices.
  • When verifying if a project's package manager configuration blocks unsafe dependency sources.
  • When checking if lifecycle scripts are properly disabled in a JS/TS repository.
  • When ensuring that dependency release age gates are active.

Advantages

  • Provides automated, consistent security checks across different package managers.
  • Offers actionable, copy-pasteable configuration fixes for identified issues.
  • Operates in a read-only mode to ensure project files remain unmodified.
  • Standardizes security posture for npm, yarn, and pnpm environments.

Usage examples

“/check-npm”
The agent scans the current directory, identifies the package manager, checks the configuration against security thresholds, and outputs a table detailing the status of each check with recommended fixes for any failures.
“Audit my project's package manager security settings.”
The agent performs a full audit of the workspace root, evaluating tool versions, script execution policies, and dependency protocols, then provides a summary report.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/grafana/check-npm/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip check-npm.zip -d .agents/skills

Documentation by Grafana Labs

npm / yarn / pnpm supply-chain audit

Read-only audit of the workspace root. Do not modify any files.

0. Detect package manager

test -f package.json || { echo "STOP: no package.json at workspace root"; exit 1; }
jq -r '.packageManager // "unset"' package.json
ls -1 yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || true

If no package.json, stop. Priority: packageManager → lockfile → default npm.

1. Tool version

npm --version    # required ≥ 11.15.0
yarn --version   # required ≥ 4.14.0
pnpm --version   # required ≥ 11.0.0

Use semver comparison. Verify pinned packageManager meets threshold.

ManagerMinimum
npm11.15.0
yarn4.14.0
pnpm11.0.0

2. Lifecycle scripts disabled

grep -E '^ignore-scripts=' .npmrc 2>/dev/null
grep -E 'enableScripts:' .yarnrc.yml 2>/dev/null
grep -E 'strictDepBuilds:|dangerouslyAllowAllBuilds:|allowBuilds:' pnpm-workspace.yaml 2>/dev/null
ManagerPASSFAIL
npm.npmrc has ignore-scripts=truemissing or false
yarnenableScripts: false or key absentenableScripts: true
pnpm ≥ 11strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/[]strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty
pnpm 10.npmrc ignore-scripts=true OR strictDepBuilds: trueneither

pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md.

3. Unsafe dependency protocols

Registry:

grep -E '^allow-git=' .npmrc 2>/dev/null
grep -E 'approvedGitRepositories:' .yarnrc.yml 2>/dev/null
grep -E 'blockExoticSubdeps:' pnpm-workspace.yaml 2>/dev/null

Scan workspace package.json files (dependencies, devDependencies, optionalDependencies, peerDependencies). Prefer workspace-member discovery (pnpm-workspace.yaml / root workspaces / lerna / rush) per references/protocols.md, then scan only those manifests. Fallback (may overmatch non-workspace manifests):

find . -name package.json -not -path '*/node_modules/*'

Safe values only: semver range, workspace:, patch:, npm: alias to semver. Flag everything else (git URLs, tarballs, user/repo shorthand, file:, link:, exec:, …) as path → name → value (protocol).

ManagerPASSFAIL
npmallow-git=none or rootmissing or all
yarnapprovedGitRepositories: [] or grafana-scoped list, or omitted with policy comment + clean scanunsafe entries or broad allow-list
pnpm ≥ 11blockExoticSubdeps unset/truefalse
pnpm 10.xblockExoticSubdeps: trueunset (default false) or false

Protocol detection order and yarn posture details: references/protocols.md.

4. Minimum release age ≥ 3 days

3 days = 4320 minutes. npm uses days; yarn and pnpm use minutes.

grep -E '^min(imum)?-release-age=' .npmrc 2>/dev/null
grep -E 'npmMinimalAgeGate:' .yarnrc.yml 2>/dev/null
grep -E 'minimumReleaseAge:|minimumReleaseAgeStrict:' pnpm-workspace.yaml 2>/dev/null
ManagerPASSFAIL
npmmin-release-age ≥ 3missing
yarnnpmMinimalAgeGate ≥ 4320 minmissing or below
pnpm ≥ 11minimumReleaseAge ≥ 4320unset (default 1440) or below
pnpm 10minimum-release-age / minimumReleaseAge ≥ 4320missing

Flag minimumReleaseAgeStrict: false on pnpm 11.

5. Report

#CheckStatusDetail
0Package manager(npm / yarn / pnpm)version: x.y.z (pinned: y.y.y if set)
1Tool version ≥ thresholdPASS / FAILactual vs required
2Scripts disabledPASS / FAILconfig line or "missing"
3Unsafe dep protocolsPASS / FAILregistry state + flagged entries
4Min release age ≥ 3 daysPASS / FAILconfig + value

Use PASS / FAIL only — no emojis.

For each FAIL, one paste-ready fix:

# npm — .npmrc
ignore-scripts=true
allow-git=none
min-release-age=3
# pnpm 11 — pnpm-workspace.yaml
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds: []
minimumReleaseAge: 4320
blockExoticSubdeps: true
# yarn — .yarnrc.yml
npmMinimalAgeGate: 4320

More fixes (tool upgrades, yarn git allow-list, pnpm 10): references/fix-snippets.md.

If all PASS: "All checks passed." and stop.

Files

ATTRIBUTION.md

Attribution

This folder is an unmodified copy of the Agent Skill "check-npm", distributed by AutoGineer (https://autogineer.com/agent-skills).

The skill's own files are unmodified copies. AutoGineer is not affiliated with or endorsed by the author or the publisher.

Files added by AutoGineer

  • ATTRIBUTION.md: this file, written by AutoGineer

  • LICENSE: copied from LICENSE

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs Node.js

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Grafana Labs
Publisher
Grafana Labs (Official)
Source
grafana/skills · skills/grafana-plugins/check-npm · commit 8fb72a5
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Grafana Labs.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download check-npm.zip