The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes pnpm for manifest and lockfile management. It proactively enforces security by mandating the --ignore-scripts flag for all install, add, and remove operations, preventing lifecycle script execution which is a common vector for malicious packages.
[EXTERNAL_DOWNLOADS]: The skill uses pnpm dlx to run auditing tools like knip, depcheck, and syncpack. It mitigates risks by requiring pinned versions and disabling scripts via --config.ignore-scripts=true for these one-off executions.
[DATA_EXFILTRATION]: Network access is performed via curl to https://registry.npmjs.org solely to fetch package metadata (publishing timestamps). This is a read-only operation targeting a well-known, trusted service to implement a 72-hour 'freshness check' safety gate.
[REMOTE_CODE_EXECUTION]: While the skill involves downloading and executing Node.js tools, it implements a mandatory 72-hour delay (freshness check) for all non-author-owned packages to ensure community/security scanner response time to potential malware. Packages under the @grafana/* scope are appropriately exempted as vendor-owned resources.

audit-and-reduce-dependencies