SKILLS/javascript-typescript-conventions/SKILL.md
Tooling and conventions for JavaScript/TypeScript projects. Use when setting up new projects, configuring ESLint/Prettier alternatives, monorepos, or library publishing.
npx skillsauth add pinkpixel-dev/skills-collection-2 javascript-typescript-conventionsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
types.ts or types/*.tsconstants.ts file// @env node
// @env browser
type or interface declarationsfoo.ts → foo.test.ts (same directory)describe/it API (not test)toMatchSnapshot for complex outputstoMatchFileSnapshot with explicit path for language-specific snapshots| Command | Description |
|---------|-------------|
| ni | Install dependencies |
| ni <pkg> / ni -D <pkg> | Add dependency / dev dependency |
| nr <script> | Run script |
| nu | Upgrade dependencies |
| nun <pkg> | Uninstall dependency |
| nci | Clean install (pnpm i --frozen-lockfile) |
| nlx <pkg> | Execute package (npx) |
Use fast-npm-meta to look up the latest version of a package — it queries a small metadata endpoint instead of downloading the full registry payload (which can be megabytes per package).
nlx fast-npm-meta version vite # 7.3.1
nlx fast-npm-meta version "nuxt@^3.5" # 3.5.22 — range-aware
nlx fast-npm-meta version vite nuxt vue # multiple at once
nlx fast-npm-meta version vite --json # JSON for scripting
nlx fast-npm-meta full vite # full version list + dist-tags
Prefer this over npm view <pkg> version when you only need the latest version, and over reading package.json from the registry directly.
{
"compilerOptions": {
"target": "ESNext",
"module": "ESNext",
"moduleResolution": "bundler",
"strict": true,
"esModuleInterop": true,
"skipLibCheck": true,
"resolveJsonModule": true,
"isolatedModules": true,
"noEmit": true
}
}
// eslint.config.mjs
import antfu from '@antfu/eslint-config'
export default antfu()
When completing tasks, run pnpm run lint --fix to format the code and fix coding style.
{
"simple-git-hooks": {
"pre-commit": "pnpm i --frozen-lockfile --ignore-scripts --offline && npx lint-staged"
},
"lint-staged": { "*": "eslint --fix" },
"scripts": {
"prepare": "npx simple-git-hooks"
}
}
Use named catalogs in pnpm-workspace.yaml for version management:
| Catalog | Purpose |
|---------|---------|
| prod | Production dependencies |
| inlined | Bundler-inlined dependencies |
| dev | Dev tools (linter, bundler, testing) |
| frontend | Frontend libraries |
Avoid the default catalog. Catalog names can be adjusted per project needs.
tools
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
data-ai
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
tools
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
testing
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.