@slashcloneSkill
Install npm packages safely by @slashclone
Install and upgrade npm packages safely, so your agent never pulls a typosquat or a freshly compromised release. Before adding a package it confirms the exact name, the latest stable version, and that the version is at least 14 days old, then pins it exactly and commits the lockfile. Also pins CI actions and container images by SHA or digest.
Before adding a package: check the version is real, stable, and not brand new.
