SKILLS/javascript-typescript-conventions/SKILL.md
Tooling and conventions for JavaScript/TypeScript projects. Use when setting up new projects, configuring ESLint/Prettier alternatives, monorepos, or library publishing.
npx skillsauth add pinkpixel-dev/skills-collection-2 javascript-typescript-conventionsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
types.ts or types/*.tsconstants.ts file// @env node
// @env browser
type or interface declarationsfoo.ts → foo.test.ts (same directory)describe/it API (not test)toMatchSnapshot for complex outputstoMatchFileSnapshot with explicit path for language-specific snapshots| Command | Description |
|---------|-------------|
| ni | Install dependencies |
| ni <pkg> / ni -D <pkg> | Add dependency / dev dependency |
| nr <script> | Run script |
| nu | Upgrade dependencies |
| nun <pkg> | Uninstall dependency |
| nci | Clean install (pnpm i --frozen-lockfile) |
| nlx <pkg> | Execute package (npx) |
Use fast-npm-meta to look up the latest version of a package — it queries a small metadata endpoint instead of downloading the full registry payload (which can be megabytes per package).
nlx fast-npm-meta version vite # 7.3.1
nlx fast-npm-meta version "nuxt@^3.5" # 3.5.22 — range-aware
nlx fast-npm-meta version vite nuxt vue # multiple at once
nlx fast-npm-meta version vite --json # JSON for scripting
nlx fast-npm-meta full vite # full version list + dist-tags
Prefer this over npm view <pkg> version when you only need the latest version, and over reading package.json from the registry directly.
{
"compilerOptions": {
"target": "ESNext",
"module": "ESNext",
"moduleResolution": "bundler",
"strict": true,
"esModuleInterop": true,
"skipLibCheck": true,
"resolveJsonModule": true,
"isolatedModules": true,
"noEmit": true
}
}
// eslint.config.mjs
import antfu from '@antfu/eslint-config'
export default antfu()
When completing tasks, run pnpm run lint --fix to format the code and fix coding style.
{
"simple-git-hooks": {
"pre-commit": "pnpm i --frozen-lockfile --ignore-scripts --offline && npx lint-staged"
},
"lint-staged": { "*": "eslint --fix" },
"scripts": {
"prepare": "npx simple-git-hooks"
}
}
Use named catalogs in pnpm-workspace.yaml for version management:
| Catalog | Purpose |
|---------|---------|
| prod | Production dependencies |
| inlined | Bundler-inlined dependencies |
| dev | Dev tools (linter, bundler, testing) |
| frontend | Frontend libraries |
Avoid the default catalog. Catalog names can be adjusted per project needs.
development
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
tools
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
testing
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
testing
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.