js-security-audit — Claude Code skill: what it does, how to install
Runs a 5-area security check on JS and TS projects across repository settings, supply-chain hygiene, CI/CD, and alerts. Flags critical risks before release.
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a claude-codeWhat js-security-audit does
The skill inspects npm, yarn, and pnpm setups by reading the lockfile in the repository root. It examines .npmrc options, package version pinning, and scoped packages. Auth routines get scanned for insecure pseudo-random generators like Math.random().
In the workflow pipeline, the skill verifies that npm ci runs with --ignore-scripts, GitHub Actions are pinned to full commit SHAs, and security linters are present. It also inspects .github/dependabot.yml to confirm update grouping and alerting rules.
Without command execution access, the audit cannot evaluate the dependency graph. Terminal execution via Bash is required to run commands such as npm audit, yarn outdated, and lockfile-lint. Output arrives as a structured report with file paths, line numbers, and actionable remediation snippets.
What it helps with
- Detect supply-chain risks and unpinned versions in package manifests
- Validate CI workflows to use
npm ciwith--ignore-scripts - Enforce full commit SHA pinning for GitHub Actions
- Generate prioritized security findings with file lines and code fixes
Example prompts for the agent
- Run a security audit on our dependencies and CI workflows
- Check package.json and lockfile for supply-chain risks
- Review our Dependabot configuration and npm scripts hardening
How to install js-security-audit
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a claude-code2Manually: put the files in place
~/.claude/skills/js-security-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/js-security-audit/
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a codex2Manually: put the files in place
.agents/skills/js-security-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a cursor2Manually: put the files in place
.cursor/skills/js-security-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install c0x12c/ai-toolkit js-security-audit2Manually: put the files in place
.github/skills/js-security-audit/SKILL.md1Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/c0x12c/ai-toolkit --path toolkit/skills/js-security-auditManually: put the files in place
.devin/skills/js-security-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about js-security-audit
How do I install js-security-audit in Claude Code?
Run npx skills add c0x12c/ai-toolkit --skill js-security-audit -a claude-code.
What does js-security-audit check?
It evaluates five areas: project setup, dependency hygiene, CI/CD pipelines, Dependabot configuration, and incident readiness. Findings are classified as Critical, Warning, or Info with exact line references.
What permissions does the skill require?
It needs permission to run Bash commands such as npm audit, pnpm audit, and lockfile-lint. You can pre-approve these commands in settings.json under permissions.allow.
