skill CX Codex

npm-security-best-practices — Claude Code skill: security and install

Q: How do I install `npm-security-best-practices` in Claude Code?

Run `npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code`, then run the same command again: `npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code`. The skill file is located at `~/.claude/skills/npm-security-best-practices/SKILL.md`.

Q: What should I check before disabling install scripts?

`ignore-scripts=true` blocks lifecycle scripts. Packages such as `esbuild` may need explicit approval through `allowBuilds` or `trustedDependencies`, so review those exceptions before applying the policy.

Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code

Open on GitHub

What npm-security-best-practices does

This skill covers npm package security, package-manager configuration, and ways to reduce supply-chain attack risk. It explains how to disable lifecycle scripts, block git dependencies, enforce release-age checks, and allow build scripts only for selected packages.

The material includes npm, pnpm, and Bun examples, plus workflows for npx, @lavamoat/allow-scripts, npq, Socket Firewall, and Snyk. It also covers .npmrc, pnpm-workspace.yaml, package.json, lockfiles, Renovate, and Dependabot. Some checks require the relevant CLI tools and Snyk authentication.

The practical tradeoff is clear: disabling scripts can break packages that need a build step, so review the allowlist before applying the settings.

What it helps with

harden npm dependency installation
block lifecycle scripts and git dependencies
check a package before adding it
delay adoption of newly released versions
review suspicious lockfile changes

Example prompts for the agent

Review this project’s npm setup and propose a safer .npmrc that disables scripts and blocks git dependencies.
Show how to install a package securely with npm, pnpm, and npx, including supply-chain checks.
Set up selective build-script permissions with @lavamoat/allow-scripts and explain which packages need approval.

How to install npm-security-best-practices

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code

2Manually: put the files in place

~/.claude/skills/npm-security-best-practices/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/npm-security-best-practices/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a codex

2Manually: put the files in place

.agents/skills/npm-security-best-practices/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a cursor

2Manually: put the files in place

.cursor/skills/npm-security-best-practices/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills npm-security-best-practices

2Manually: put the files in place

.github/skills/npm-security-best-practices/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/npm-security-best-practices

Manually: put the files in place

.devin/skills/npm-security-best-practices/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill npm-security-best-practices -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about npm-security-best-practices

How do I install npm-security-best-practices in Claude Code?

Run npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code, then run the same command again: npx skills add reason-machines/security-skills --skill npm-security-best-practices -a claude-code. The skill file is located at ~/.claude/skills/npm-security-best-practices/SKILL.md.

What does npm-security-best-practices do?

It guides the agent through safer npm, pnpm, and Bun configuration, supply-chain risk reduction, and dependency-script control. It also covers checks with npq, Socket Firewall, and Snyk.

What should I check before disabling install scripts?

ignore-scripts=true blocks lifecycle scripts. Packages such as esbuild may need explicit approval through allowBuilds or trustedDependencies, so review those exceptions before applying the policy.

Similar skills

Everything for Security →

check-npm grafana Reads a JS/TS repo's package manager config and flags supply-chain gaps: tool version, lifecycle scripts, unsafe dependency protocols and release age. CX Codex +1 2,800installs sap-dependency-security secondsky Guards SAP projects against supply chain risks and enforces strict executable rules for MCP servers. Useful when upgrading libraries in SAP CAP or BTP. CX Codex +1 558installs aube-package-manager reason-machines Guidance for using aube, a Rust-based Node.js package manager, across dependencies, workspaces, CI, and migrations from other package managers. CX Codex +1 392installs add-npm-dependency elirantutia A skill that walks the agent through npm dependency changes in an Electron app: three build targets, CSS copying, native module rebuilds. CX Codex +1 ★ 1,388repo stars dependency-upgrade secondsky Upgrades dependencies without the usual risk: sets a cooldown on new versions, blocks postinstall scripts, and rolls out changes in stages. CX Codex +1 404installs npm-package jwynia A skill that walks the agent through building an npm library on Bun: scaffolding, strict TypeScript, tests, bundling and publishing. CX Codex +1 331installs

From the same set17

malware-analysis-dragonflyTomb-avast A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs sparkfinderoven-security-compliance-skills A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling. CX Codex +1 759installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs