Skip to content
SlashClone
DiscoverUse in ClaudeSubmit a link
Sign in
Made by@slashclone

Pin dependencies safely

@slashclone/pin-dependencies-safely

Before adding or upgrading a package: confirm the version exists, is the latest stable release, and is at least 14 days old, then pin it exactly and commit the lockfile. A simple guard against typosquats and freshly compromised releases.

SkillDevOpsv0.1.0 (latest)
Use in Claude Save Like Clone Comment
Activity
New: be the first to try it

How this works

  1. It is a skill: written instructions Claude reads when your request matches what the skill is for. You do not call it by name; just ask for the task.
  2. While it works, it reads and changes files in the places it lists, nowhere else.
  3. It runs these commands on your computer: npm view, pnpm add.
  4. It talks to registry.npmjs.org over the internet.
  5. Nothing runs until you choose to use it, and you can remove it any time.

SKILL.md

Pin dependencies safely

Most supply-chain incidents ship as a brand-new version or a look-alike name. Waiting two weeks and pinning exactly avoids most of them.

Before installing

  1. Right package: confirm the exact name with the person and check it on the registry (npm view <name> name repository.url). Watch for look-alike names.
  2. Exists and stable: npm view <name> dist-tags.latest gives the latest stable release. Do not use pre-release tags unless asked.
  3. At least 14 days old: npm view <name> time --json and check the publish date of that version. If it is newer, use the newest version that is at least 14 days old, and say so.
  4. Ask first if the project keeps a list of approved dependencies and this one is not on it.

Installing

  • Pin the exact version (pnpm add <name>@1.2.3 --save-exact or npm install --save-exact). No ^ or ~.
  • Commit the lockfile in the same change.
  • Pin CI actions and container images the same way: full commit SHAs or digests, with the version in a comment.

Report

Tell the person the name, version, publish date, and why it was chosen.

Files

  • SKILL.md
  • kit.json

Did it work?

0worked for them0did not work

Sign in to say whether it worked for you.

Nobody has said yet. Tried it? Tell the next person.