Pin dependencies safely

Name: Pin dependencies safely
Author: @slashclone

@slashclone/pin-dependencies-safely

Before adding or upgrading a package: confirm the version exists, is the latest stable release, and is at least 14 days old, then pin it exactly and commit the lockfile. A simple guard against typosquats and freshly compromised releases.

SkillDevOpsv0.1.0 (latest)

Use in Claude Save Like Clone Comment

Activity: New: be the first to try it
Installs: 0 installs
Likes: 0 likes
Clones: 0 clones

0.1.0
5 Nov 2026
Scan passedNo tests

Use in Claude

Claude Code

/kit add @slashclone/pin-dependencies-safely

CLI

slashclone add @slashclone/pin-dependencies-safely

Codex

slashclone add @slashclone/pin-dependencies-safely --agent codex

Not enforced. Codex does not enforce the permissions this kit declares.

Cursor

slashclone add @slashclone/pin-dependencies-safely --agent cursor

Not enforced. Cursor does not enforce the permissions this kit declares.

claude.ai and the desktop app

Download for Claude

Not enforced. claude.ai and the Claude desktop app do not enforce the permissions this kit declares. How to upload it

As a file

Download .kit

One file with everything in it. slashclone add ./file.kit checks it against this page before installing.

Review before installing

Set up SlashClone in Claude

Health

No keep-alive checks yet

Checks run weekly once someone keeps the kit installed.

Run reports are off

Safety

Scan passed
Not reviewed yet
No tests

This kit reads package.json, **/package.json, pnpm-lock.yaml, package-lock.json, writes to package.json, **/package.json, pnpm-lock.yaml, package-lock.json, connects to registry.npmjs.org and runs npm view, pnpm add. Install it?

Full scan and review

Similar kits

Env secrets check
@shipcheck
Check your repo for leaked secrets before you push or launch: .env files git tracks or will pick up, .env files hiding in git history, server keys behind NEXT_PUBLIC_ or VITE_ prefixes that ship to the browser, provider key shapes (Stripe, AWS, GitHub, OpenAI, Anthropic, Supabase service_role), and passwords hardcoded in code. Reports names and redacted hints, never the values.
Product rename checklist
@slashclone
Rename a product across code, copy, CLI, plugins, and docs without breaking anything: one name constant, a careful sweep, and a list of strings that must keep the old name (signing labels, key-derivation labels, OAuth client ids, stored rule ids, migrations). Shows the plan and asks before it edits.
Deploy doctor
@shipcheck
Paste a failed Vercel or Netlify build log and get the most likely cause and a fix you can apply. Recognizes about twenty common failures: letter-case import errors, missing packages, missing env vars, prerender errors, window is not defined, lockfile drift, peer dependency conflicts, wrong Node version, out of memory, wrong output or root folder, oversized functions, and more.
Dev prod parity rule
@slashclone
A CLAUDE.md rule that keeps development and production behaving the same: prefer explicit environment flags over NODE_ENV checks, and write down every unavoidable difference in the deploy guide in the same change.

Link

https://slashclone.dev/@slashclone/pin-dependencies-safely

README badge

[![Install with SlashClone](https://slashclone.dev/badge/slashclone/pin-dependencies-safely.svg)](https://slashclone.dev/@slashclone/pin-dependencies-safely)

Embed

<iframe src="https://slashclone.dev/embed/slashclone/pin-dependencies-safely" width="480" height="200" title="@slashclone/pin-dependencies-safely" loading="lazy"></iframe>

Share card image

More from @slashclone

Product rename checklist
Rename a product across code, copy, CLI, plugins, and docs without breaking anything: one name constant, a careful sweep, and a list of strings that must keep the old name (signing labels, key-derivation labels, OAuth client ids, stored rule ids, migrations). Shows the plan and asks before it edits.
Two theme brand colors
Find brand colors that work in both light and dark mode: for each hue, the shade with the best WCAG contrast against all your light and dark backgrounds at once, so a logo or accent can keep one color in both themes. Prints a table and saves the results as JSON.
Canvas frame capture
Check a canvas or WebGL animation frame by frame when the browser cannot take screenshots (a hidden pane, a background tab, a headless run). Captures timed frames from the page itself and saves them as small images you can look at. Writes only to a frames folder you choose.
Search eval sweep
Measure search quality with a fixed set of real queries: hits, misses, and false positives at the current cutoff and across a sweep of cutoffs, so ranking and threshold changes are chosen from data instead of guesses. Works for keyword, semantic, or hybrid search.

See all of @slashclone's kits

Report this kit