Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree.
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install openplayerjs/openplayerjs audit-fix --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/audit-fix .claude/skills/audit-fix && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .claude/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fixType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install openplayerjs/openplayerjs audit-fix --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/audit-fix .agents/skills/audit-fix && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .agents/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install openplayerjs/openplayerjs audit-fix --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/audit-fix .cursor/skills/audit-fix && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .cursor/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/openplayerjs/openplayerjs.git --path .claude/skills/audit-fix--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install openplayerjs/openplayerjs audit-fix --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/audit-fix .gemini/skills/audit-fix && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .gemini/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install openplayerjs/openplayerjs audit-fixInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/audit-fix .github/skills/audit-fix && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .github/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add openplayerjs/openplayerjs --skill audit-fix -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install openplayerjs/openplayerjs audit-fix --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openplayerjs/openplayerjs.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/audit-fix .opencode/skills/audit-fix && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "audit-fix" agent skill from https://github.com/openplayerjs/openplayerjs/tree/master/.claude/skills/audit-fix into .opencode/skills/audit-fix/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-fix", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
audit-fixResolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree.
Audit Fix is an agent skill from openplayerjs/openplayerjs. Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree. Use when asked to fix an audit finding, a CVE, a GHSA advisory, or when the "Dependency audit" GitHub check is red. Covers the deterministic pnpm-workspace.yaml override procedure, what it can't fix, and why the E1 "ask before adding/upgrading a dependency" rule doesn't block this specific case.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Vulnerability scanning, Audit readiness and Monorepo tooling. It works with pnpm, GitHub and TypeScript. The repository describes itself as: Lightweight HTML5 video/audio player with smooth controls and ability to play VAST/VMAP/SIMID/OMID/non-linear ads. The licence is MIT.
2 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit c26914a. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
pnpmnpmFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use pnpm and npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Audit Fix loads about 1k tokens when it runs. Until then it costs about 102 tokens; SKILL.md has 514 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from openplayerjs/openplayerjs at commit c26914a, republished under its MIT licence (© openplayerjs). 514 words, ~1,037 tokens.
.claude/skills/audit-fix/SKILL.md (or your agent's skills folder).This procedure is implemented as a script, not just documentation: scripts/audit-fix.cjs
does exactly what this page describes, and .github/workflows/dependency-audit.yml's
audit-fix job runs it automatically on same-repo PRs when the audit job goes red,
pushing the fix onto the PR branch and commenting the result. Run the same script yourself
for a manual fix, a fork PR (which the bot can't push to), or a push-to-master failure
(the bot only acts on PRs) — the procedure and the guardrails are identical either way.
Root CLAUDE.md E1 lists "adding or upgrading any dependency" as ask-first. This procedure
is exempt from that only when both hold:
pnpm-workspace.yaml's overrides: block — never a
dependencies/devDependencies edit in any package.json.pnpm install followed by pnpm audit --audit-level=high comes back clean afterward.That's the same mechanism every existing entry in that block already uses (see the "Supply-chain security" comment above it) — this skill just makes running it repeatable instead of ad hoc. Anything that doesn't fit those two constraints (below) still needs a human, same as any other dependency change.
pnpm run audit:fixWhat it does, in order (see scripts/audit-fix.cjs for the implementation):
pnpm audit --json, keeps advisories at high/critical (matches the
--audit-level=high gate).patched_versions —
smallest possible diff, not necessarily latest.pnpm-workspace.yaml's overrides: block
(alphabetically, matching its existing convention).pnpm install, then re-runs pnpm audit to confirm the advisory is gone.Then run the standard gate before committing:
pnpm run build && pnpm run test(The audit-fix job in CI skips this — the existing build/coveralls workflows already
re-run on the commit it pushes. A manual run should still verify locally.)
Commit as chore(deps): ... (scope deps, R12) — scripts/audit-fix-report.cjs --format=commit <summary.json> renders a ready message from the JSON summary if
AUDIT_FIX_SUMMARY_PATH was set when you ran the fix.
dependencies entry of a published package
(currently: @dailymotion/vast-client, @dailymotion/vmap in packages/ads). An
overrides entry only fixes this workspace's lockfile/audit — it does not change what
npm installing that published package resolves for a downstream consumer, because
overrides are a pnpm/root-lockfile-only concept. This needs an actual version bump in
that package's package.json, which changes what ships to consumers — ask first, same as
any dependency change. Cross-check with pnpm why <pkg> to see the real path.minimumReleaseAge (the 5-day supply-chain
cooldown in pnpm-workspace.yaml). This surfaces as a pnpm install failure. Do not
add the package to minimumReleaseAgeExclude to work around it — that list is a
deliberate, reviewed exception, not a bypass valve. Wait for the cooldown to pass, or ask
the user if it's urgent enough to warrant a reviewed exclusion.Any advisory in one of these buckets stays unfixed by design — the audit CI job stays red
until a human resolves it, which is the correct outcome, not a bug in the automation.
© openplayerjs, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .claude/skills/audit-fix of openplayerjs/openplayerjs.
Open the folder on GitHubat commit c26914a
Audit Fix next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Audit Fix this skillopenplayerjs/openplayerjs | 649 | — | ~1k | Automated safety check: Pass | MIT | |
| Linea Dependency MaintenanceConsensys-Incorporated/linea-attestation-registry | 177 | 1 repos | ~3.7k | Automated safety check: Warn | MIT | |
| Fix Security PRunional/typescript-blackbook | 133 | — | ~1.4k | Automated safety check: Warn | MIT | |
| Archestra Dev Override Sweeparchestra-ai/archestra | 4.3k | — | ~1.4k | Automated safety check: Pass | Custom licence | |
| Link Workspace Packagesnomcopter/react-mosaic | 4.8k | 5 repos | ~760 | Automated safety check: Pass | Custom licence | |
| Pnpm Engineteambit/bit | 18k | — | ~1.9k | Automated safety check: Pass | Custom licence |
Consensys-Incorporated/linea-attestation-registry
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…
unional/typescript-blackbook
Fix a PR that is failing due to security or vulnerability issues — npm/pnpm/yarn/bun audit failures, CVE alerts, Dependabot merge conflicts, Snyk failures, or GitHub security advisory blocks.
archestra-ai/archestra
A skill your agent uses when asked to sweep, clean up, or revisit pnpm overrides and minimumReleaseAge exclusions in platform/pnpm-workspace.yaml — unwinding a matured temporary CVE pin once its fix…
nomcopter/react-mosaic
Link workspace packages in monorepos (npm, yarn, pnpm, bun).
teambit/bit
Work on the pnpm Rust engine (@pnpm/napi, the pacquet crates) that bit install runs through.
seasonedcc/remix-forms
Release a new version of the remix-forms npm package. An agent skill from seasonedcc/remix-forms.
openplayerjs/openplayerjs
Add, rename, change the payload of, or remove a typed player event in OpenPlayerJS.
openplayerjs/openplayerjs
Run the full OpenPlayerJS verification gauntlet before committing, opening a PR, or preparing a release.
openplayerjs/openplayerjs
Write or extend Jest tests for OpenPlayerJS to this repo's exact conventions — makeCore factories, typed internals handles instead of as any, media property mocking, fake timers, ads/vast mocks, and…
openplayerjs/openplayerjs
Find and safely apply ONE worthwhile code optimization (reuse, simplification, efficiency, or a dead-weight cleanup) somewhere in packages//src, with new regression tests proving behavior is…
Works with
Categories
Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree. Audit Fix is an agent skill from openplayerjs/openplayerjs. Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree.
Audit Fix fits situations like: asked to fix an audit finding; A GHSA advisory; the Dependency audit GitHub check is red.
Run `npx skills add openplayerjs/openplayerjs --skill audit-fix -a claude-code`. Or copy the skill folder (.claude/skills/audit-fix in openplayerjs/openplayerjs) into .claude/skills/audit-fix in your project. Claude Code loads it when a task matches its description.
Run `npx skills add openplayerjs/openplayerjs --skill audit-fix -a codex`. Or copy the skill folder (.claude/skills/audit-fix in openplayerjs/openplayerjs) into .agents/skills/audit-fix in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add openplayerjs/openplayerjs --skill audit-fix -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-fix, .gemini/skills/audit-fix, .github/skills/audit-fix and .opencode/skills/audit-fix in your project.
Going by SKILL.md and its folder, Audit Fix needs the command-line tools its instructions call (pnpm and npm). Our summary lists: Node.js.
SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Audit Fix is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Audit Fix: Linea Dependency Maintenance (Consensys-Incorporated/linea-attestation-registry, 177 stars), Fix Security PR (unional/typescript-blackbook, 133 stars), Archestra Dev Override Sweep (archestra-ai/archestra, 4.3k stars) and Link Workspace Packages (nomcopter/react-mosaic, 4.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
openplayerjs (a GitHub organization) maintains it in openplayerjs/openplayerjs, which has 649 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on October 5, 2026.
Source: openplayerjs/openplayerjs on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
