---
name: "npm-audit-fix-resolver"
description: "Analyze and safely resolve transitive dependency vulnerabilities in Node.js projects."
metadata:
  author: "npm"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run npm audit"
  - "fix vulnerabilities with npm audit fix"
  - "resolve transitive npm cve"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# npm audit Vulnerability Analysis & Resolution

Audits package-lock.json with npm audit: inspecting dependency trees, identifying vulnerable packages, evaluating breaking changes, and applying non-breaking fixes with npm audit fix.

## When to Invoke
Invoke this skill whenever you need to:
- run npm audit
- fix vulnerabilities with npm audit fix
- resolve transitive npm cve

## Execution SOP & Rules
1. Execute npm audit --audit-level=high to filter out low-severity advisory noise.
2. Run npm audit fix to automatically upgrade compatible semver patches.
3. Use the overrides field in package.json to pin transitive dependencies when upstream packages delay updates.
4. Never run npm audit fix --force in production repositories without rigorous test suite verification.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.