JS Security Audit
c0x12c/ai-toolkit
Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.
Regenerate both npm lockfiles after any manual change to package.json.
Install Sync Lockfiles
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install fjrevoredo/mini-diarium sync-lockfiles --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/sync-lockfiles .claude/skills/sync-lockfiles && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .claude/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfilesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install fjrevoredo/mini-diarium sync-lockfiles --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/sync-lockfiles .agents/skills/sync-lockfiles && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .agents/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install fjrevoredo/mini-diarium sync-lockfiles --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/sync-lockfiles .cursor/skills/sync-lockfiles && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .cursor/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/fjrevoredo/mini-diarium.git --path .agents/skills/sync-lockfiles--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install fjrevoredo/mini-diarium sync-lockfiles --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/sync-lockfiles .gemini/skills/sync-lockfiles && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .gemini/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install fjrevoredo/mini-diarium sync-lockfilesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/sync-lockfiles .github/skills/sync-lockfiles && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .github/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install fjrevoredo/mini-diarium sync-lockfiles --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/fjrevoredo/mini-diarium.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/sync-lockfiles .opencode/skills/sync-lockfiles && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "sync-lockfiles" agent skill from https://github.com/fjrevoredo/mini-diarium/tree/master/.agents/skills/sync-lockfiles into .opencode/skills/sync-lockfiles/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sync-lockfiles", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
sync-lockfiles- GitHub stars
- 308
- Token cost
- ~364 tokens
- SKILL.md length
- 100 words
- Files
- 1
- Skills in repo
- 41
- Repo updated
- First seen
- Licence
- MIT
At a glance
Regenerate both npm lockfiles after any manual change to package.json.
- Works in 3 steps: Regenerate bun.lock → Regenerate package-lock.json → Commit package.json, bun.lock, and…
- The user has added
- SKILL.md covers Steps, Why --legacy-peer-deps and Gotcha
- Calls npm
What it does
Sync Lockfiles is an agent skill from fjrevoredo/mini-diarium. Regenerate both npm lockfiles after any manual change to package.json. Use this skill when the user has added, removed, or bumped a dependency in package.json and needs bun.lock and package-lock.json kept in sync. Triggers: "sync lockfiles", "update lockfiles", "I edited package.json", "regenerate lockfiles". Distinct from apply-dependency-prs, which handles the PR-discovery workflow — this skill handles lockfile sync only.
Its SKILL.md is about 360 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Development, covering Dependency management. It works with npm and ESLint. The repository describes itself as: A local-only journal with serious encryption. Free, open source, and never touches the internet. The licence is MIT.
When your agent uses it
- The user has added
- Bumped a dependency in package.json and needs bun.lock and package-lock.json kept in sync
Example prompts
- “sync lockfiles”
- “update lockfiles”
- “I edited package.json”
- “/sync-lockfiles”
Requirements
- Node.js
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Regenerate bun.lock
- Regenerate package-lock.json
- Commit package.json, bun.lock, and package-lock.json together.
What it can do on your machine
Read from SKILL.md and the folder at commit 3ddc537. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npm
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Sync Lockfiles loads about 364 tokens when it runs. Until then it costs about 111 tokens; SKILL.md has 100 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from fjrevoredo/mini-diarium at commit 3ddc537, republished under its MIT licence (© fjrevoredo). 100 words, ~364 tokens.
Download SKILL.mdSave it as
.claude/skills/sync-lockfiles/SKILL.md (or your agent's skills folder).- name
- sync-lockfiles
- description
- Regenerate both npm lockfiles after any manual change to package.json. Use this skill when the user has added, removed, or bumped a dependency in package.json and needs bun.lock and package-lock.json kept in sync. Triggers: "sync lockfiles", "update lockfiles", "I edited package.json", "regenerate lockfiles". Distinct from apply-dependency-prs, which handles the PR-discovery workflow — this skill handles lockfile sync only.
When package.json changes, two lockfiles must both be updated and committed together:
| File | Used by |
|---|---|
bun.lock | Dev workflow |
package-lock.json | Flathub flatpak-node-generator (offline Linux build) |
Steps
Regenerate
bun.lock:bash cmd.exe /c bun installRegenerate
package-lock.json:bash cmd.exe /c npm install --package-lock-only --legacy-peer-depsCommit
package.json,bun.lock, andpackage-lock.jsontogether.
Why --legacy-peer-deps
eslint-plugin-solid declares a peer of eslint@^9 but the project uses eslint@10. bun
resolves this silently; npm does not. The flag is required or npm install errors out.
Gotcha
Never commit only one lockfile. package-lock.json is required by Flathub's
flatpak-node-generator to resolve npm dependencies during the offline Flatpak build. A
stale or missing package-lock.json causes the Flathub CI build to fail.
© fjrevoredo, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/sync-lockfiles of fjrevoredo/mini-diarium.
Open the folder on GitHubat commit 3ddc537
Compare with similar skills
Sync Lockfiles next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Sync Lockfiles this skillfjrevoredo/mini-diarium | 308 | — | ~364 | Automated safety check: Pass | MIT | |
| JS Security Auditc0x12c/ai-toolkit | 106 | — | ~1.6k | Automated safety check: Warn | None | |
| Validator Dependency Upgradeexpress-validator/express-validator | 6.2k | — | ~1.2k | Automated safety check: Pass | MIT | |
| Claude Code Version Checkykdojo/claude-code-tips | 10k | — | ~1.8k | Automated safety check: Pass | Custom licence | |
| Linea Dependency MaintenanceConsensys-Incorporated/linea-attestation-registry | 177 | 1 repos | ~3.7k | Automated safety check: Warn | MIT | |
| RStudio Electron Version Updaterstudio/rstudio | 5.1k | — | ~964 | Automated safety check: Pass | Custom licence |
Similar skills
Validator Dependency Upgrade
express-validator/express-validator
Walks maintainers through bumping the pinned validator package in express-validator and syncing chain types, implementations and options with the new release.
Claude Code Version Check
ykdojo/claude-code-tips
Recommends whether to stay on the installed Claude Code version, update, or pin another one by comparing npm tags, release timing and the changelog.
Linea Dependency Maintenance
Consensys-Incorporated/linea-attestation-registry
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…
RStudio Electron Version Update
rstudio/rstudio
Bumps the pinned Electron version across the RStudio repository, updating NEWS.md, package.json, the lockfile and the allowScripts entry.
Aube Package Manager Helper
aubepkg/aube
Manages Node.js dependencies, scripts and installs with aube, aubr and aubx, choosing the right command by its effect and preserving the project's existing lockfile and workspace format.
More from fjrevoredo/mini-diarium
All 41 skills in this repoManual Planning
fjrevoredo/mini-diarium
Create, update, review, and execute manual Markdown implementation plans when harness planning mode is not being used.
M10 Performance
fjrevoredo/mini-diarium
CRITICAL: Use for performance optimization. An agent skill from fjrevoredo/mini-diarium.
Solidjs
fjrevoredo/mini-diarium
SolidJS framework development skill for building reactive web applications with fine-grained reactivity.
Rust Symbol Analyzer
fjrevoredo/mini-diarium
Analyze Rust project structure using LSP symbols. An agent skill from fjrevoredo/mini-diarium.
Tauri V2
fjrevoredo/mini-diarium
Tauri v2 cross-platform app development with Rust backend. An agent skill from fjrevoredo/mini-diarium.
Exploration Mode
fjrevoredo/mini-diarium
Enter exploration mode: a thinking partner for researching and thinking through ideas and problems before implementation.
Related
Categories
Questions about Sync Lockfiles
What does Sync Lockfiles do?
Regenerate both npm lockfiles after any manual change to package.json. Sync Lockfiles is an agent skill from fjrevoredo/mini-diarium.json.
When should I use Sync Lockfiles?
Sync Lockfiles fits situations like: the user has added; bumped a dependency in package.json and needs bun.lock and package-lock.json kept in sync.
How do I install Sync Lockfiles in Claude Code?
Run `npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a claude-code`. Or copy the skill folder (.agents/skills/sync-lockfiles in fjrevoredo/mini-diarium) into .claude/skills/sync-lockfiles in your project. Claude Code loads it when a task matches its description.
How do I install Sync Lockfiles in Codex?
Run `npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a codex`. Or copy the skill folder (.agents/skills/sync-lockfiles in fjrevoredo/mini-diarium) into .agents/skills/sync-lockfiles in your project. Codex loads it when a task matches its description.
Can I use Sync Lockfiles in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add fjrevoredo/mini-diarium --skill sync-lockfiles -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sync-lockfiles, .gemini/skills/sync-lockfiles, .github/skills/sync-lockfiles and .opencode/skills/sync-lockfiles in your project.
What does Sync Lockfiles need to run?
Going by SKILL.md and its folder, Sync Lockfiles needs the command-line tools its instructions call (npm). Our summary lists: Node.js.
Does Sync Lockfiles access the network?
SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Sync Lockfiles safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Sync Lockfiles use?
Sync Lockfiles is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Sync Lockfiles use?
About 364 tokens (SKILL.md is roughly 1.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Sync Lockfiles?
Skills that share tags, products or a category with Sync Lockfiles: JS Security Audit (c0x12c/ai-toolkit, 106 stars), Validator Dependency Upgrade (express-validator/express-validator, 6.2k stars), Claude Code Version Check (ykdojo/claude-code-tips, 10k stars) and Linea Dependency Maintenance (Consensys-Incorporated/linea-attestation-registry, 177 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Sync Lockfiles?
fjrevoredo (a GitHub user) maintains it in fjrevoredo/mini-diarium, which has 308 GitHub stars. The repository holds 41 skills in this directory. The repository was last updated on October 7, 2026.
Source: fjrevoredo/mini-diarium on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.