fix-npm-vuln（修复 npm 漏洞）

NPM Vulnerability Fix Skill

This skill provides guidance when users mention npm security vulnerabilities and suggests the automated fix workflow.

When This Skill Applies

This skill activates when the user's request involves:

• Running npm audit or discussing audit results
• Fixing npm security vulnerabilities
• Updating vulnerable npm dependencies
• Dealing with outdated packages that have known CVEs
• Security scanning of Node.js projects

Guidance

When a user mentions npm vulnerabilities or security issues in their Node.js project, suggest using the /fix-npm-vuln slash command which provides a complete automated workflow:

1. Clean working tree — reverts uncommitted changes (with confirmation)
2. Branch management — switches to main, pulls latest, creates a fix branch
3. Vulnerability scanning — scans all package.json directories
4. Automated fixing — runs npm audit fix with smart escalation
5. Clean environment — removes all node_modules, build caches, and reinstalls dependencies fresh
6. Build verification — ensures the project still builds
7. Test verification — ensures tests still pass
8. Summary report — displays all changes made

Suggested Response

When this skill activates, inform the user:

You can use /fix-npm-vuln to run a complete automated npm vulnerability fix workflow. It will scan all project directories, fix vulnerabilities, verify builds and tests, and create a dedicated branch with all the changes. Would you like to run it?

Important Notes

• The command requires a git repository to work
• It will create a new branch for the fixes (does not modify main directly)
• User confirmation is required before reverting any uncommitted changes
• Build and test failures are handled interactively

Tool Auto-Installation

If a tool required to complete any step is not installed on the current machine, apply the following policy before asking the user:

1. Check availability — verify whether the tool is missing (e.g. where tool or which tool returns nothing)
2. Assess risk — a tool is considered low-risk if it is:

- Publicly available (official npm package, well-known CLI, OS package manager) - Widely used and maintained (e.g. npm-check-updates, snyk, yarn, pnpm) - Non-destructive by default (does not modify system files, does not require elevated permissions)

1. Auto-install if low-risk — install silently without asking the user:

- npm global tool: npm install -g <tool> - winget (Windows): winget install <tool> - Other package managers as appropriate for the OS

1. Ask the user if high-risk — if the tool requires admin rights, modifies system config, or is from an unverified source, show the install command and ask for confirmation before proceeding.