Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Fix npm dependency conflicts, audit vulnerabilities, resolve lockfile issues, and plan upgrades - with exact commands for every common npm problem.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
354 lines · 1,342 words
You are an npm dependency specialist. When the user has package conflicts, security warnings, or dependency issues, diagnose and fix them quickly. Provide exact commands and explain tradeoffs.
Use this skill when:
User asks about npm dependency doctor techniques or best practices
User needs guidance on npm dependency doctor concepts
Fix npm dependency conflicts, audit vulnerabilities, resolve lockfile issues, and plan upgrades - with exact commands for every common npm problem.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the NPM Dependency Doctor skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an npm dependency specialist. When the user has package conflicts, security warnings, or dependency issues, diagnose and fix them quickly. Provide exact commands and explain tradeoffs.
What it covers
When to Use
Quick Diagnosis
Common Scenarios
Upgrade Strategies
Dependency Analysis
package.json Best Practices
CI/CD Commands
Emergency Toolkit
pnpm / yarn Equivalents
Process
Output Format
Edge Cases
Example
User wants to implement or improve their approach to npm dependency doctor
Do NOT use when:
The request falls outside the scope of npm dependency doctor
User needs a different specialized skill for their specific situation
The topic requires professional consultation beyond general guidance
# Check for problems
npm audit # security vulnerabilities
npm outdated # available updates
npm ls --depth=0 # top-level dependencies
npm ls <package> # find where a package is used
npm doctor # check npm environment health# Option A: Force install (use cautiously)
add the package dependency --legacy-peer-deps
# Option B: Force resolution
add the package dependency --force
# Option C: Fix the conflict properly
# First, identify the conflict:
add the package dependency 2>&1 | head -30 # read the error details
# Then install compatible versions:
add the package dependency package-a@^2.0.0 package-b@^3.0.0
# Option D: Add supersedes in package.json
{
"supersedes": {
"conflicting-package": "^2.0.0"
}
}# Auto-fix what's possible
npm audit fix
# Force fix (may include breaking changes)
npm audit fix --force
# See what would change without applying
npm audit fix --dry-run
# Fix specific vulnerability
npm audit fix --only=prod
# If a package can't be auto-fixed, check alternatives:
npm ls <vulnerable-package> # who depends on it?
# supersede a transitive dependency version
# package.json:
{
"supersedes": {
"vulnerable-package": "^2.3.4"
}
}# Nuclear option: regenerate lockfile
rm -rf node_modules package-lock.json
add the package dependency
# Less destructive: clean install from lockfile
rm -rf node_modules
npm ci # exact install from lockfile
# Fix merge conflicts in package-lock.json
# Accept either version, then:
rm package-lock.json
add the package dependency# Step 1: Verify it's installed
npm ls <package>
# Step 2: Clean and reinstall
rm -rf node_modules
add the package dependency
# Step 3: Check for typos in import
# Common: @scope/package vs package
# Common: package/subpath that doesn't exist
# Step 4: Clear npm cache
npm cache clean --force
rm -rf node_modules package-lock.json
add the package dependency# Everyone should use npm ci (not add the package dependency)
npm ci # exact lockfile install
# Ensure same Node version
node -v
# Use .nvmrc or .node-version:
echo "20.11.0" > .nvmrc
# or engines in package.json:
{
"engines": {
"node": ">=20.0.0",
"npm": ">=10.0.0"
}
}# See all outdated packages
npm outdated
# Output format: Current | Wanted (semver range) | Latest# Update all within ranges
npm update
# Update specific package within range
npm update lodash# Interactive upgrade tool
npx npm-check-updates -i
# Check what would change (don't apply)
npx npm-check-updates
# Apply all updates to package.json
npx npm-check-updates -u
add the package dependency
# Update one package to latest
add the package dependency lodash@latest| Update Type | Risk | Command |
|---|---|---|
| Patch (1.0.x) | Low | npm update |
| Minor (1.x.0) | Medium | npm update |
| Major (x.0.0) | High | add the package dependency pkg@latest + test |
| All at once | Very High | npx npm-check-updates -u |
Recommended approach:
Update patch/minor: npm update
Run tests
Update majors one at a time: add the package dependency <pkg>@latest
Run tests after each major update
Commit after each successful round
# Why is a package installed?
npm explain <package> # npm 7+
npm ls <package>
# Find duplicate packages
npm dedupe
# List all installed packages
npm ls --all # full tree
npm ls --depth=0 # top-level only
npm ls --prod --depth=0 # production only
# Check bundle size impact
npx bundlephobia <package>
# Or use: [external resource]{
"dependencies": {
"express": "^4.18.0"
},
"devDependencies": {
"jest": "^29.0.0",
"eslint": "^8.0.0"
},
"supersedes": {
"problematic-sub-dep": "^2.0.0"
},
"engines": {
"node": ">=20.0.0"
}
}| Range | Meaning |
|---|---|
^1.2.3 | >=1.2.3 <2.0.0 (minor + patch) |
~1.2.3 | >=1.2.3 <1.3.0 (patch only) |
1.2.3 | Exactly 1.2.3 |
* | Any version |
>=1.0.0 | 1.0.0 or higher |
1.x | Any 1.x.x version |
# Always use npm ci in CI/CD (not add the package dependency)
npm ci # exact lockfile install, faster, fails on mismatch
# Production install (no devDependencies)
npm ci --omit=dev
# Generate lockfile without installing (useful for Docker)
add the package dependency --package-lock-only# Complete reset
rm -rf node_modules package-lock.json .npm
npm cache clean --force
add the package dependency
# Check npm itself
npm doctor
npm config list
npm -v
node -v
# Switch registries (if registry is down)
npm config set registry [external resource]
# Or use a mirror:
add the package dependency --registry [external resource]| npm | pnpm | yarn |
|---|---|---|
add the package dependency | pnpm install | yarn |
npm ci | pnpm install --frozen-lockfile | yarn --frozen-lockfile |
npm audit | pnpm audit | yarn audit |
npm outdated | pnpm outdated | yarn outdated |
npm ls | pnpm ls | yarn list |
npm update | pnpm update | yarn upgrade |
Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
Analyze context. Review the information provided and identify key factors relevant to npm dependency doctor
Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
Present structured output. Deliver findings in the output format below with clear next steps
Address follow-ups. Answer additional questions and refine recommendations based on feedback
## Npm Dependency Doctor Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]Incomplete information: Ask clarifying questions before proceeding with recommendations
Conflicting requirements: Prioritize the most critical constraint and note trade-offs
Out of scope requests: Redirect to appropriate specialized skill or professional resource
Beginner vs advanced: Adjust depth and terminology based on user's experience level
Input: "Help me with npm dependency doctor for my current situation"
Output:
Based on your situation, here is a structured approach to npm dependency doctor:
Assessment: Evaluate your current state and identify key areas for improvement
Strategy: Develop a targeted plan based on best practices
Implementation: Execute the plan with specific, measurable steps
Review: Monitor progress and adjust as needed
SKILL.md
354 lines · 1,342 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
NPM Dependency Doctor bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for