Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add G1Joshi/Agent-Skills --skill pnpmgit clone --depth 1 https://github.com/G1Joshi/Agent-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/g1joshi/agent-skills/pnpm)<a href="https://agentmods.dev/skills/g1joshi/agent-skills/pnpm"><img src="https://agentmods.dev/badge/skills/g1joshi/agent-skills/pnpm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/g1joshi/agent-skills/pnpm"><img src="https://agentmods.dev/badge/skills/g1joshi/agent-skills/pnpm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.00398 |
| Opus 5 | $0.00010 | $0.00199 |
| Sonnet 5 | $0.00004 | $0.00080 |
| Haiku 4.5 | $0.00002 | $0.00040 |
Grade A, and why
pnpm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
pnpm
pnpm is fast and disk-efficient. It uses a Content Addressable Store and hard links to avoid duplicating packages. v9 (2025) adds Catalogs.
When to Use
- Disk Space: Saves GBs by storing one copy of
lodashglobally. - Speed: Installation is instant if packages are already in the store.
- Monorepos: Excellent workspace support with strict isolation.
Quick Start
# Enable via Corepack
corepack enable
corepack prepare pnpm@latest --activate
pnpm add next
Core Concepts
Content Addressable Store
~/.local/share/pnpm/store. All packages live here. Projects assume node_modules structure via symlinks.
Strict Resolution
Unlike npm/yarn (classic), pnpm does not flatten node_modules. You cannot access dependency-of-dependency unless you declare it.
Catalogs (v9)
Define version groups in pnpm-workspace.yaml. e.g. catalog:react-18 ensures all packages use exact same versions.
Best Practices (2025)
Do:
- Use CI Caching: pnpm is fast, but setup
pnpm-storecaching in GitHub Actions to make it instant. - Use
pnpm -r: Run commands recursively across the monorepo. - Use
only-allow: Addpreinstallscript to force team to use pnpm.
Don't:
- Don't shame hoist: If legacy tools break with symlinks, use
shamefully-hoist=truein.npmrcas a temporary fix.
References
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 55 lines · 19 tokens per session scan A 21176f968a17
pnpm is a skill published in the GitHub repository G1Joshi/Agent-Skills (12 stars, last pushed 7mo ago), licensed MIT. It adds 19 tokens to every session and 398 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
sveltekit-and-svelte5-runes
Complete architecture patterns, state management with Svelte 5 Runes ($state, $derived, $effect, $props), SvelteKit SSR/streaming pipelines, form actions, and production anti-patterns.
electron-crossplatform-performance
Production architecture, multi-process IPC security, V8 memory management, native node modules, window lifecycle optimization, and cross-platform desktop execution using Electron. Use when building, hardening, or tuning performance for enterprise Electron apps across Windows, macOS, and Linux.
prisma-orm-patterns-and-migrations
Best practices for Prisma ORM schema design, high-performance query optimization, preventing N+1 problems, zero-downtime database migrations, connection pooling, and multi-tenant data modeling. Use when building Node.js/TypeScript applications with Prisma.
javascript-typescript-typescript-scaffold
You are a TypeScript project architecture expert specializing in scaffolding production-ready Node.js and frontend applications. Generate complete project structures with modern tooling (pnpm, Vite, N.
jest-unit
Unit testing skill using Jest for TypeScript and JavaScript, covering mocking, spies, snapshots, coverage, async testing, and custom matchers.
refactor-values
Safe refactoring workflow for enum values, enum keys, and static test data in test-data/static/.ts — mandatory impact analysis, cascading updates, and verification. Use BEFORE changing any enum member's string value (ApiEndpoints., Messages., Roles, StorageStatePaths), renaming any enum key, or editing any existing…