Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add llbbl/pnpm-upgrade-skills --skill migrate-to-pnpm-11git clone --depth 1 https://github.com/llbbl/pnpm-upgrade-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/llbbl/pnpm-upgrade-skills/migrate-to-pnpm-11)<a href="https://agentmods.dev/skills/llbbl/pnpm-upgrade-skills/migrate-to-pnpm-11"><img src="https://agentmods.dev/badge/skills/llbbl/pnpm-upgrade-skills/migrate-to-pnpm-11/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/llbbl/pnpm-upgrade-skills/migrate-to-pnpm-11"><img src="https://agentmods.dev/badge/skills/llbbl/pnpm-upgrade-skills/migrate-to-pnpm-11.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.07059 |
| Opus 5 | $0.00053 | $0.03529 |
| Sonnet 5 | $0.00021 | $0.01412 |
| Haiku 4.5 | $0.00011 | $0.00706 |
Grade D, and why
migrate-to-pnpm-11 scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo corepack enable Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf node_modules How it starts
The opening of the file, as written. The whole thing — 734 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/migrate-to-pnpm-11
Migrate a project to pnpm 11 and adopt its supply-chain security defaults.
Why pnpm 11
pnpm 11 (released 2026-04-28) turns on five supply-chain defaults that were opt-in or absent before:
| Setting | Default in v11 | Purpose |
|---|---|---|
minimumReleaseAge |
1440 (24 h) |
Refuse to install package versions younger than the cooldown window. Blocks the typical "publish-malware → wait for CI to pull it" window. |
blockExoticSubdeps |
true |
Transitive deps cannot come from git URLs or arbitrary tarballs. |
strictDepBuilds |
true |
Any dependency with a postinstall/build script that is not on the allowBuilds allowlist fails the install with ERR_PNPM_IGNORED_BUILDS. |
verifyDepsBeforeRun |
install |
pnpm run <script> re-checks the lockfile before running. |
optimisticRepeatInstall |
true |
Skip work when the lockfile is unchanged. |
Plus: lockfile entries are re-validated against minimumReleaseAge even if the lockfile was committed under a weaker policy, Git-hosted deps get integrity pinning, and pnpm audit signatures verifies ECDSA registry signatures.
Prerequisites
- Node.js ≥ 22. pnpm 11 is pure ESM and drops Node 18/20.
- A clean working tree (or be willing to commit/stash before migrating — the migration touches lockfiles,
package.json,.npmrc, and may createpnpm-workspace.yaml).
Git workflow
This skill does not run git commit, git push, or gh pr directly. After the migration is verified, summarize the changes for the user and let them (or a separate commit/PR workflow) handle the commit.
Before editing any files, create a feature branch. The migration touches lockfiles, package.json, .npmrc, pnpm-workspace.yaml, the Dockerfile, and CI configs — too much for a stray commit on main.
git status # confirm clean tree
git checkout -b chore/migrate-to-pnpm-11
If the working tree isn't clean, stop and ask the user how to proceed (stash, commit elsewhere, or abort). Do not migrate on top of unrelated in-progress work.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 734 lines · 107 tokens per session scan D 72683ac497ae
migrate-to-pnpm-11 is a skill published in the GitHub repository llbbl/pnpm-upgrade-skills (1 stars, last pushed 3mo ago), licensed MIT. It adds 107 tokens to every session and 7,059 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
npm-security
Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating packages or configuring package managers.
frontmcp-extensibility
Use when extending FrontMCP beyond the core SDK by integrating external npm packages, libraries, or third-party services into providers and tools. Covers VectoriaDB for in-memory semantic and vector search (ML-based embeddings or TF-IDF keyword engines, with persistence) and the tamper-evident, hash-chained skill…
javascript-expert
Expert-level JavaScript development with modern ES2024+ features, Node.js, npm ecosystem, and best practices. Use when the user mentions ECMAScript, ES2024, Node.js, npm, or web, or when the task involves Modern JavaScript, Node.js Development, Modern Tooling, or Functional Programming.
typed-events
Type-safe validated wrappers for browser CustomEvent, BroadcastChannel, and window.postMessage APIs using any standard-schema-compatible validator (zod, valibot, arktype). Use when implementing createEvent, createEventMap, createBroadcastChannel, createBroadcastEvent, or createMessage. For React hooks (useListener…
astro-iconify-svgmap
Astro integration that generates optimized SVG sprite maps from @iconify-json/ icon packs for SSG sites. Add createIntegration() to astro.config.mjs, import virtual:iconify-svgmap in your base layout to activate the plugin, then call getIcon(pack, name) in .astro components to register icons and get hrefs. Use…
eslint-config
Composable ESLint flat config for TypeScript projects. Use config() with presets.base spread to activate baseline, javascript, typescript, imports, jsdoc, unicorn, perfectionist, prettier, regexp, command, packagejson, pnpm, gitignore, node, e18e configs. autoEnable detects installed packages (astro, svelte, lit…