接続

Secure Dependency Upgrade

secondskybysecondsky
•
239
•
セキュリティとテスト

Executes secure dependency upgrades with supply chain protection, release cooldown periods, and automated lockfile hardening.

The Secure Dependency Upgrade skill equips Claude Code with defense-in-depth workflows to safely update packages across npm, pnpm, Bun, Yarn, and Deno. It protects projects against software supply chain attacks by enforcing release cooldown windows, blocking dangerous post-install lifecycle scripts, and validating lockfile integrity. Designed for engineering teams handling major framework upgrades or establishing zero-trust package manager configurations, this skill orchestrates pre-install audits with npq and Socket CLI, assists in staged rollouts, and generates hardened CI/CD configurations for tools like Dependabot and Renovate.

主な機能

01Deterministic and frozen install enforcement with automated lockfile-lint integrity checks
02Supply chain attack prevention with configurable release cooldown periods across major package managers
03Lifecycle script blocking and allowlisting to stop arbitrary code execution during installation
04Deep pre-install security audits using Socket CLI and npq to catch typosquatting and malware
05Automated CI/CD configuration generation for Dependabot and Renovate with staged upgrade strategies
06239 GitHub stars

ユースケース

01Migrating major frameworks and library versions safely without breaking dependencies or introducing vulnerabilities
02Hardening local and CI package manager setups against zero-day supply chain attacks and malicious packages
03Setting up automated, scheduled dependency maintenance pipelines with cooldown gates in GitHub Actions