check-npm
Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
Install
With your agent
Install OMGSkills skill "grafana/skills:check-npm" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/grafana/skills /tmp/skills && ln -s /tmp/skills/skills/grafana-plugins/check-npm ~/.claude/skills/check-npmFrom README
npm / yarn / pnpm supply-chain audit Read-only audit of the workspace root. Do not modify any files. Detect package manager If no package.json, stop. Priority: packageManager → lockfile → default npm. Tool version Use semver comparison. Verify pinned packageManager meets threshold. | Manager | Minimum | |---------|---------| | npm | 11.15.0 | | yarn | 4.14.0 | | pnpm | 11.0.0 | Lifecycle scripts disabled | Manager | PASS | FAIL | |---------|------|------| | npm | .npmrc has ignore-scripts=true | missing or false | | yarn | enableScripts: false or key absent | enableScripts: true | | pnpm ≥ 11 | strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/[] | strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty | | pnpm 10 | .npmrc ignore-scripts=true OR strictDepBuilds: true | neither | pnpm 11+ ignores script settings in .npmrc and package.json#pnpm. pnpm 10 / yarn edge cases: references/managers.md.
More from this repo
k6-docs
Used to write or review k6 documentation across the three k6 repositories - k6-DefinitelyTyped (TypeScript types),...
adaptive-metrics
Cut Grafana Cloud Metrics cost by shrinking active-series count with Adaptive Metrics aggregation rules —...
admin
Used to manage Grafana Cloud accounts — organizations, stacks, RBAC roles and assignments, SSO/SAML/OAuth/GitHub auth,...