What problem does it solve? Running npm install on an unfamiliar repository can execute malicious lifecycle scripts, install typosquatted dependencies, or exfiltrate credentials before you ever see the code. This Skill performs a layered security audit on npm, pnpm, and yarn projects so you can vet a GitHub repo, npm package, or local project before any code executes. ## Core Features & Use Cases - Lifecycle Script Detection: Scans every package.json (including monorepo workspaces) for dangerous preinstall, postinstall, prepare, and install hooks that run shell commands, curl, eval, or base64-decoded payloads. - Lock File and Dependency Integrity: Detects non-registry package sources in pnpm-lock.yaml, package-lock.json, and yarn.lock, runs the package manager's audit command, and flags typosquatting candidates resembling popular packages like react, lodash, or express. - Code Pattern and Obfuscation Analysis: Identifies child_process usage, eval, base64 blobs, single-line compressed files in config files, credential-read-plus-network-call combinations, persistence mechanisms, and suspicious git history changes. - Use Case: You cloned a random GitHub repo and want to run it locally. Invoke this Skill to get a severity-ranked report of red flags, false-positive context, safe inspection commands, and a post-incident checklist if you already ran something suspicious. ## Quick Start Ask the agent to audit the cloned repository in the current directory for security risks before running npm install.
