Imported from bedkillerspacex-boop/codex-skill-library (javascript-npm-audit-ops/SKILL.md). Install upstream with npx skills add bedkillerspacex-boop/codex-skill-library --skill javascript-npm-audit-ops. Copyright stays with the author.

JavaScript npm Audit Ops

Name: javascript-npm-audit-ops
Author: bedkillerspacex-boop

Scope And Authorization

In scope: systems, clusters, repos, and apps you own or have written authorization to assess/change.
Out of scope: unauthorized scanning, exploitation, credential abuse, or third-party harm.
Prefer non-production validation; use change windows for production.
Redact secrets, tokens, personal data, and customer identifiers from notes and tickets.
Pair implementation changes with code-quality-standards.

When To Use

Wiring npm audit / pnpm audit / OSV/Snyk/Socket into CI.
Triage CRITICAL/HIGH advisories on production lockfiles.
Using overrides to force fixed transitive versions safely.
Establishing SLA for dependency remediation on JS services.

Do Not Use As Primary

Need	Skill instead
License scanning	`javascript-license-scan`
Malware/suspicious packages	`javascript-malware-sandbox`
Image signing	`javascript-notation-ops`
General vuln SLA	`matching vuln-sla skill if present`
Implementation quality baseline	`code-quality-standards`

Domain Focus

Area	Guidance
Lockfile	Source of truth; commit it; reproducible installs
Audit	npm audit, pnpm audit, yarn npm audit, OSV-Scanner
Triage	Reachability, prod vs devDep, exploit maturity
Fix	Update, override, replace, or accept with expiry
CI	Fail on new HIGH+ in production deps
Noise	Dev-only tools may be lower priority

Workflow

1. Baseline

npm ci clean; run audit JSON; count by severity.
Classify prod runtime vs toolchain.
Success: CI blocks new HIGH+; backlog owned for rest.

2. Remediate

Prefer direct upgrades; test.
Use overrides carefully; re-test natives.
Remove abandoned packages.
Exception tickets with expiry for accepted risk.

3. Automate

Dependabot/Renovate grouped PRs.
Pin actions; cache npm with integrity.
Dashboard of open advisories age.

Verify with evidence

npm ci
npm audit --omit=dev --json > audit.json || true
npm audit --omit=dev --audit-level=high
# pnpm
pnpm audit --prod
# OSV
# osv-scanner -L package-lock.json
# Override example in package.json: "overrides": { "foo": "^1.2.3" }
npm ls foo
npm test

Keep command output redacted (keys, tokens, customer IDs, kubeconfigs).
Attach before/after evidence to the change or ticket.
Prefer automated tests or CI gates where regressions are likely.

Good / Bad

Topic	Good	Bad
CI	Fail new HIGH+ prod	`npm audit` ignored
Lockfile	Committed + ci	Floating installs on prod
Triage	Reachability notes	Panic upgrade all majors blind
Exception	Expiry + owner	Permanent ignore script

Triage questions

Is the package in the production dependency graph?
Is the vulnerable function reachable?
Is there a fixed version?
What is exploit maturity / public PoC?
What is the residual risk if deferred?

Output Checklist

Audit baseline stored
CI gate configured
CRITICAL/HIGH owned or fixed
Overrides documented
Renovate/Dependabot on
Exceptions with expiry
code-quality-standards applied if code/config shipped
Residual risk and next review date noted

Rules

Do not disable scripts globally without understanding breakages — but beware malicious install scripts.
Audit clean ≠ secure app logic.
Only modify owned repos.
Authorized/owned/lab scope only; evidence over guesses.
Never paste live secrets, private keys, or customer PII into notes or chat.
Keep this skill focused on javascript-npm-audit-ops; route neighbors via the catalog/index.

{ "ocm": "1", "id": "bedkillerspacex-boop-codex-skill-library-javascript-npm-c28391", "kind": "skill", "name": "javascript-npm-audit-ops", "description": "Operate npm/yarn/pnpm vulnerability auditing for Node.js projects: CI gates, severity triage, `overrides`/`resolutions`, advisory noise handling, and upgrade playbooks. Use for owned repositories maintaining secure dependency posture — pairs with license scan for compliance.", "publisher": "bedkillerspacex-boop", "version": "1.0.0", "capabilities": { "domains": [ "coding", "legal" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Operate npm/yarn/pnpm vulnerability auditing for Node.js projects: CI gates, severity triage, `overrides`/`resolutions`, advisory noise handling, and upgrade playbooks. Use for owned repositories maintaining secure dependency posture — pairs with license scan for compliance." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/bedkillerspacex-boop/codex-skill-library", "path": "javascript-npm-audit-ops/SKILL.md", "ref": "eed9fd05579890130b25214473a7970a5b4d776a", "url": "https://github.com/bedkillerspacex-boop/codex-skill-library/blob/eed9fd05579890130b25214473a7970a5b4d776a/javascript-npm-audit-ops/SKILL.md", "key": "bedkillerspacex-boop/codex-skill-library/javascript-npm-audit-ops/SKILL.md" } }, "instructions": "# JavaScript npm Audit Ops\n\n## Scope And Authorization\n\n- **In scope:** systems, clusters, repos, and apps you own or have written authorization to assess/change.\n- **Out of scope:** unauthorized scanning, exploitation, credential abuse, or third-party harm.\n- Prefer non-production validation; use change windows for production.\n- Redact secrets, tokens, personal data, and customer identifiers from notes and tickets.\n- Pair implementation changes with `code-quality-standards`.\n\n## When To Use\n\n- Wiring `npm audit` / `pnpm audit` / OSV/Snyk/Socket into CI.\n- Triage CRITICAL/HIGH advisories on pr", "cost": { "context_tokens": 927 } }

javascript-npm-audit-ops

About