thunderid: Skill for Claude Code

Fix npm Vulnerability

You are resolving a security advisory in a pnpm monorepo.

Step 0 — Gather the advisory details

Ask the user for one or both of:

What vulnerability do you want to fix? Provide a CVE ID (e.g. CVE-2026-44705), GHSA slug (e.g. GHSA-w7jw-789q-3m8p), or vulnerable package name. Optionally paste the pnpm audit output line for it.

Wait for the answer before proceeding.

---

Step 1 — Locate the workspace root

Find the directory containing pnpm-workspace.yaml, starting from the current directory and walking up:

dir=$(pwd); while [ "$dir" != "/" ]; do [ -f "$dir/pnpm-workspace.yaml" ] && echo "$dir" && break; dir=$(dirname "$dir"); done

If nothing is found, ask the user to navigate to the monorepo root first.

All subsequent commands run from this root.

---

Step 2 — Get the full audit picture

pnpm audit --json 2>/dev/null | jq '.advisories // .vulnerabilities // .' 2>/dev/null | head -400

Identify for each advisory matching the user's input:

• vulnerablePackage — the transitive package that contains the flaw
• patchedVersions — the version range that fixes it (e.g. >=4.0.6)
• via — the dependency chain showing which head (direct workspace) dep pulls it in
• advisoryId — CVE or GHSA identifier
• severity — high / critical

---

Step 3 — Traverse the dependency chain

Use pnpm why to confirm the full chain from the workspace to the vulnerable package:

pnpm why <vulnerable-package> 2>&1 | head -60

This shows every head dep that transitively depends on it. Record:

• The head package(s) (direct workspace deps) pulling in the vulnerable version
• The current version of those head packages

---

Step 4 — Check if updating the head dep resolves the issue

For each head package, inspect what version of the vulnerable package its latest release ships:

# Latest available version of the head dep
npm info <head-package> version

# Its full dependency tree for the vulnerable package
npm info <head-package>@latest dependencies --json 2>/dev/null | jq '.<vulnerable-package> // "not direct"'

# If it's deeper, check peer dependencies too
npm info <head-package>@latest peerDependencies --json