Lockfile Diff + SBOM

Dependency changes are a primary vector for supply chain attacks and breaking releases. This skill identifies exactly what changed in your lockfiles, flagging high-risk signals like major version bumps, new install scripts, and dependencies pulled from unverified git or non-registry URLs. It provides a zero-dependency, offline mechanism to audit package changes before they hit production.

What it does

• Diff lockfiles across formats, including npm, Yarn, and pnpm, to compare package names and resolved versions.
• Identify risk signals by flagging new install scripts and dependencies resolved from git repositories or direct URLs.
• Detect major bumps to highlight breaking change risks that require manual changelog review.
• Generate SBOMs in a CycloneDX-lite JSON format for compliance and release inventory requirements.
• Inventory components by extracting name, version, purl, and integrity hashes from local lockfile data.

How it works

1. Selection of the mode (diff or sbom) and the target file paths or project directories.
2. Execution of the bundled Node.js script to parse lockfile structures without making any network calls.
3. Analysis of the generated JSON report to prioritize new external sources, scripts, and major version shifts.
4. Triage of findings, manually verifying any flagged git sources or potential typosquats.

Frameworks & tools

This tool uses a bundled Node.js script (v18+) with zero external dependencies. It supports package-lock.json, npm-shrinkwrap.json, yarn.lock, and pnpm-lock.yaml.

Why this beats prompting it yourself

Parsing complex lockfile formats like Yarn's line-based schema or nested npm trees is prone to hallucination and regex errors in raw LLM prompts. This skill uses a specialized, offline script to extract ground-truth data, ensuring that every reported version and risk signal is actually present in the file.

Use cases

• PR reviews to verify that a "simple dependency update" didn't sneak in an unverified git source.
• Release audits to generate a component manifest for compliance before shipping a new version.
• Migration checks to ensure version parity when switching from Yarn to npm or vice versa.
• CI gating to automatically flag major version bumps or new install scripts in automated pipelines.

Known limitations

Does not perform vulnerability (CVE) scanning. Yarn and pnpm lockfiles do not support install script detection. pnpm support is best-effort due to the lack of a bundled YAML parser.