Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bodadotsh/npm-security-best-practices --skill npm-securitygit clone --depth 1 https://github.com/bodadotsh/npm-security-best-practicesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bodadotsh/npm-security-best-practices/npm-security)<a href="https://agentmods.dev/skills/bodadotsh/npm-security-best-practices/npm-security"><img src="https://agentmods.dev/badge/skills/bodadotsh/npm-security-best-practices/npm-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bodadotsh/npm-security-best-practices/npm-security"><img src="https://agentmods.dev/badge/skills/bodadotsh/npm-security-best-practices/npm-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 18 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 24 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 30 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 32 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium MCP Rug Pull · line 67 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00915 |
| Opus 5.5 | $0.00017 | $0.00366 |
| Sonnet 5.5 | $0.00009 | $0.00183 |
| Haiku 4.5 | $0.00004 | $0.00092 |
Grade A, and why
npm-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Apply the following security best practices. NEVER override an explicit user opt-in config (lifecycle scripts, cooldowns, save prefix, etc) unless they ask. Always check current package manager's verions, and verify against their official documentations.
Best Practices
Best practices are safer and sensible environmental defaults that should be enabled for the agent's runtime, we are using npm as example here but you should check to see which package manager is available and apply the configurations according.
Lifecycle scripts
Unless explicitly defined otherwise, package managers should have lifecycle scripts set as off, for example preinstall and postinstall.
In .npmrc, this can be set as ignore-scripts=true, or through install command: npm install --ignore-scripts <package>.
Dependency cooldowns / minimum release age
Unless explicitly defined otherwise, dependency installations should respect a cooldown period (default to 3 days).
In .npmrc, this can be set as min-release-age=3, or through install command npm install --min-release-age=3 <package>.
Exact versions
Unless explicitly defined otherwise, package installations should install the expact version instead of a semver range.
In .npmrc, this can be set as save-exact=true, or through install command npm install --save-exact <package>
Persist these defaults in the project
.npmrc(or the package manager’s equivalent), merging only keys that are unset; never overwrite existing values unless the user asks.
Planning stage / package scorers
When planning third-party dependencies, we should score package candidates first. This reduces risk of greyware (not malware, but can be trollware, abandonware, low quality, license changes, etc).
Few free and trustworthy scorers are:
- Socket MCP Server: https://github.com/SocketDev/socket-mcp
- https://deps.dev/
- OpenSSF Scorecard: https://github.com/ossf/scorecard
For example, Socket MCP server can be figured as:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +5 lines c3285f684770
- 1mo ago First seen · 86 lines · 43 tokens per session scan A 23529ab30adb
npm-security is a skill published in the GitHub repository bodadotsh/npm-security-best-practices (858 stars, last pushed 25d ago), licensed MIT. It adds 43 tokens to every session and 915 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pnpm
Skill "pnpm" from pledgeandgrow/pledge-skills, covering pnpm documentation skill, key benefits, file index, quick start and install pnpm.
nodejs-runtime
Use this skill when the user needs to install, upgrade, or troubleshoot Node.js, npm, pnpm, yarn, and JavaScript/TypeScript runtime environments. Covers four-tier fallback strategy: (1) DesireCore HTTP API for in-app installation, (2) DesireCore built-in Volta CLI for Node.js + package manager version management, (3)…
create-pr
Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for Prisma 8. Use when the user wants to create a pull request, open a PR, or submit changes for review.
draft-release-notes
Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…
publish-npm-version
Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…
record-upgrade-instructions
Record upgrade instructions alongside a Prisma 8 breaking-change PR, so downstream consumers (users of @internal/ and authors of Prisma 8 extensions) can apply the matching code translation automatically via the published upgrade skills. Use when you have refactored framework code and the test suite went red in…