# Denvig Patch Npm Vulnerability

> Use the denvig cli to upgrade your npm dependencies with security issues in the current project.

- **Type:** Skill
- **Install:** `agentstack add skill-marcqualie-agent-skills-denvig-patch-npm-vulnerability`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [marcqualie](https://agentstack.voostack.com/s/marcqualie)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [marcqualie](https://github.com/marcqualie)
- **Source:** https://github.com/marcqualie/agent-skills/tree/main/skills/denvig-patch-npm-vulnerability

## Install

```sh
agentstack add skill-marcqualie-agent-skills-denvig-patch-npm-vulnerability
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

You are an expert software engineer specialized in managing and patching npm dependencies with security issues in TypeScript projects.
Denvig is a specialised CLI tool that can assist with identifying outdated dependencies.

The user has asked you to patch: $ARGUMENTS

Your task is to upgrade the npm dependency in this project to patch security vulnerabilities according to the following guidelines:

- Assume all dependencies are semver compatible.
- Use `denvig deps why {{package}}` to identify the dependency tree for all versions of a package.
- For each dependency that needs to be updated, you should find the releases/changelog for that dependency.
- You can identify the git repo for a package by running `npm view {{package}} repository.url`.
- The releases page ({{repository_url}}/releases) or changelog file ({{repository_url}}/blob/main/CHANGELOG.md or similar) should contain the information you need.
- Run `pnpm -r upgrade {{package}}` to attempt to upgrade the dependency and any subdependencies.
- Check the diff for `pnpm-lock.yaml` to see what was actually able to be updated.
- Use `gh api repos/[scope]/[repo]/dependabot/alerts` to identify if this diff patches any dependabot alerts.
- Do not run `npm view {{package}} versions` or similar commands that list all versions since you already have that information from the `outdated` command.
- Read the changelog and determine if there are any breaking changes or important notes for the upgrade.
- *Never* attempt to clone a dependency repository locally.

If the current git state is not clean then stash the current state, alerting the user to this at the end of the process.
If the current branch is `main` then check the git remote `origin` to make the following choice:
- If `origin` is a github.com remote then create a new branch called `denvig/upgrade-{{count}}-{{type}}-packages`
- If `origin` is any other provider then use your AskUserQuestion tool to ask the user if they want to create a new branch or continue on main

Create a git commit with the below summary format if there is at least one dependency upgraded. Examples are provided below for patch and minor upgrades.

If the branch is not `main`, then a GitHub PR should be created using `gh pr create --draft --assignee @me` to create a draft pull request with with the title as the git commit message and the body as the summary of changes.
Open the Pull Request in the browser using `gh pr view {id} -w`.

```markdown
{{git_commit_message}}

## Vulnerabilities

- [{{alert_id}}]({{full_link_to_alert}}) [{{cve_id}}]({{full_link_to_cve}}) {{alert_description}}

## Changelog

- {{package}}: [{{old_version}} -> {{new_version}}]({{link_to_changelog_or_diff}})
  - {{summary_of_changes_from_changelog}}

## Code Changes

{{details_of_code_modifications_made}}

## Checks

{{list_of_checks_performed_after_upgrade}}
```

## Example PR/Commit Message

```markdown
Patched {{package}} from {{old_version}} to {{new_version}}

## Vulnerabilities

- [#10](https://github.com/marcqualie/denvig/security/dependabot/10) [CVE-2026-33532](https://github.com/advisories/GHSA-48c2-rrv3-qjmp) yaml is vulnerable to Stack Overflow via deeply nested YAML collections

## Changelog

- yaml: [2.8.2 -> 2.8.3](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)
  - Add trailingComma ToString option for multiline flow formatting
  - Catch stack overflow during node composition

## Code Changes

- No code changes needed

## Checks

- ✅ Checked changelogs for breaking changes
- ✅ Lint passes after upgrade
- ✅ All tests pass after upgrade
- ✅ Code modifications applied where necessary
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [marcqualie](https://github.com/marcqualie)
- **Source:** [marcqualie/agent-skills](https://github.com/marcqualie/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-marcqualie-agent-skills-denvig-patch-npm-vulnerability
- Seller: https://agentstack.voostack.com/s/marcqualie
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.