mcpField
S
security

security

github.com/keejkrejSecurity138 installsUpdated 18w ago
Repository

About security

A security skill for maintainers configuring dependency policies in Bun, npm, pnpm, or uv repositories. It applies a seven-day package maturity window based on the managers actually in use, while preserving unrelated settings.

Key features

  1. 01Set a seven-day release maturity window
  2. 02Detect package managers used by the repository
  3. 03Update only relevant configuration files
  4. 04Preserve existing formatting and unrelated settings
  5. 05Explain the limits of age gating

Use cases

  1. 01Configure package maturity for a Bun project
  2. 02Set a team policy in npm or pnpm repositories
  3. 03Restrict new PyPI package resolution with uv

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/keejkrej/based-skills --skill security

After installing, type/securityin Claude Code to confirm it loaded.

Details

From the project README

Security: Minimum Release Age

Apply a seven-day registry package maturity window by default.

Constants

  • Use seven days.
  • Convert as needed: 7 days = 10080 minutes = 604800 seconds.
  • Add only the package managers the repo actually uses.
  • Keep auth tokens and secrets out of committed config.

Settings

ToolFileKeySeven-day value
Bunbunfig.toml [install]minimumReleaseAge604800
npm.npmrcmin-release-age7
pnpmpnpm-workspace.yamlminimumReleaseAge10080
uvpyproject.toml [tool.uv] or uv.tomlexclude-newer"7 days"

Bun

  • Add root bunfig.toml, or update the existing file.
  • Use minimumReleaseAgeExcludes only for narrow exceptions.
[install]
minimumReleaseAge = 604800

Docs: https://bun.sh/docs/runtime/bunfig#installminimumreleaseage

npm

  • Add project-level .npmrc for team policy.
  • Do not combine min-release-age with before.
  • Use exclusions only for narrowly justified packages.
min-release-age=7

Docs: https://docs.npmjs.com/cli/using-npm/config#min-release-age

pnpm

  • For pnpm 11.x, put non-auth settings in pnpm-workspace.yaml.
  • If no workspace file exists, add a minimal one and include the current package.
  • Use minimumReleaseAgeExclude only for narrow exceptions such as internal scopes.
  • For older pnpm repos, migrate old .npmrc age settings when upgrading.
minimumReleaseAge: 10080

Docs: https://pnpm.io/settings#minimumreleaseage

uv

  • Set exclude-newer for PyPI resolution.
  • Prefer "7 days" for readability.
  • Use exclude-newer-package only for narrow per-package overrides.
[tool.uv]
exclude-newer = "7 days"

exclude-newer = "7 days"

Docs: https://docs.astral.sh/uv/reference/settings/#exclude-newer

Workflow

  • Detect managers from lockfiles and config: bun.lock, bunfig.toml, package.json, other lockfiles, pnpm-workspace.yaml, pyproject.toml, uv.toml.
  • Update only relevant files.
  • Preserve existing formatting and unrelated settings.
  • Run the normal install, sync, or lock command after changing policy.
  • If resolution fails, tighten version ranges, wait for maturity, or add a narrow exclusion.
  • Mention the seven-day policy in PR notes or contributor docs when appropriate.

Limits

  • Use age gating as one layer, not a replacement for lockfile review, script restrictions, private registry controls, or secret scanning.
  • Check upstream behavior when using Git, tarball, path, or private registry dependencies.

Comments

Markdown supported