# js-security-audit

Runs a 5-area security check on JS and TS projects across repository settings, supply-chain hygiene, CI/CD, and alerts. Flags critical risks before release.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 109
- Author: c0x12c
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/c0x12c/ai-toolkit/tree/HEAD/toolkit/skills/js-security-audit/SKILL.md
- Updated: 2026-06-18
- HTML: https://affpapa.org/en/nevibecode/skills/js-security-audit

## What it does

The skill inspects npm, yarn, and pnpm setups by reading the lockfile in the repository root. It examines `.npmrc` options, package version pinning, and scoped packages. Auth routines get scanned for insecure pseudo-random generators like `Math.random()`.

In the workflow pipeline, the skill verifies that `npm ci` runs with `--ignore-scripts`, GitHub Actions are pinned to full commit SHAs, and security linters are present. It also inspects `.github/dependabot.yml` to confirm update grouping and alerting rules.

Without command execution access, the audit cannot evaluate the dependency graph. Terminal execution via Bash is required to run commands such as `npm audit`, `yarn outdated`, and `lockfile-lint`. Output arrives as a structured report with file paths, line numbers, and actionable remediation snippets.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/js-security-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/js-security-audit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/js-security-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/js-security-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install c0x12c/ai-toolkit js-security-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/js-security-audit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/c0x12c/ai-toolkit --path toolkit/skills/js-security-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/js-security-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add c0x12c/ai-toolkit --skill js-security-audit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/c0x12c/ai-toolkit/tree/HEAD/toolkit/skills/js-security-audit/SKILL.md

## When to use it
- Detect supply-chain risks and unpinned versions in package manifests
- Validate CI workflows to use `npm ci` with `--ignore-scripts`
- Enforce full commit SHA pinning for GitHub Actions
- Generate prioritized security findings with file lines and code fixes

## Example prompts
- Run a security audit on our dependencies and CI workflows
- Check package.json and lockfile for supply-chain risks
- Review our Dependabot configuration and npm scripts hardening

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [c0x12c/ai-toolkit](https://affpapa.org/en/nevibecode/by/c0x12c/ai-toolkit.md) — 33 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md