NPM Package Scanner

Scan npm packages used in a repository for risk, maintenance health, and upgrade concerns.

This is an instruction-only repo-inspection skill that mostly does what it says: reads package manifests and runs package-manager audits. Before using it, ensure the required tools (rg, jq, npm, and currently required bun) are actually available — bun may be unnecessary for many projects but is declared mandatory. Be aware that npm/pnpm/yarn audit commands contact package registries (network activity) and may return noisy results; the skill does not request secrets. Also note the skill references local helper files (references/*.md) that are not included. If you want to use it on a repo that uses pnpm or yarn, either install those tools or update the skill to declare them. If you’re unsure, run the commands manually first to confirm outcomes and network behavior before granting the agent autonomous runs.

Type: OpenClaw Skill Name: npm-package-scanner Version: 1.0.0 The NPM Package Scanner skill is a standard utility designed to audit repository dependencies for security and maintenance risks. It uses legitimate tools such as `rg`, `npm audit`, and `bun audit` to inspect manifest files (e.g., package.json) and identify vulnerabilities. The instructions in SKILL.md are transparent, align with the stated purpose, and include explicit constraints against modifying the environment without user permission.