How do I install the Fix Node skill?

Run npx skillmds@latest add quay/fix-node in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fix Node safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fix Node?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fix Node free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fix Node?

quay (@quay) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fix Node by quay — Agent Skill

Name: Fix Node
Author: quay

File contents

Fix Node.js CVE

Inputs

Input	Required
`PACKAGE`	yes
`FIXED_VERSION`	yes
`CVE_ID`	yes
`REPO_DIR`	yes (cwd)
`NODEJS_DIRS`	default `.` `web/`
`USE_PNPM_WEB`	default false — set true when web/ uses pnpm
`PNPM_VERSION`	default `10` — CI pnpm major version

Strategy

Direct lockfile update first (sufficient for most transitive CVEs)
Overrides in package.json only when update cannot reach fixed version
Verify lockfile shows package@<FIXED_VERSION> before commit
Do not commit package.json unless overrides were required

Steps

1. Update each directory

For each dir in NODEJS_DIRS with a package.json:

cd "${DIR}"

if [ "$USE_PNPM_WEB" = true ] && [ "$DIR" = "web/" ]; then
  corepack prepare "pnpm@${PNPM_VERSION}" --activate
  rm -rf node_modules
  pnpm update "${PACKAGE}@${FIXED_VERSION}" --lockfile-only 2>/dev/null || \
    pnpm update "${PACKAGE}" --lockfile-only 2>/dev/null || true
  npm update "${PACKAGE}" --package-lock-only 2>/dev/null || true
  # Fallback if lockfile-only update did not reach FIXED_VERSION:
  # python3 "${CLAUDE_PLUGIN_ROOT}/scripts/patch-pnpm-lock.py" web/pnpm-lock.yaml "$PACKAGE" "$OLD" "$FIXED"
  # Validate CI will accept the lockfile (do not use this to apply the bump):
  pnpm install --frozen-lockfile
else
  npm update "${PACKAGE}@${FIXED_VERSION}" 2>/dev/null || npm update "${PACKAGE}" 2>/dev/null || true
fi

cd "$REPO_DIR"

2. Override fallback

If lockfile version is still below FIXED_VERSION:

jq --arg pkg "$PACKAGE" --arg ver "${FIXED_VERSION}" \
  '.overrides[$pkg] = $ver | .pnpm.overrides[$pkg] = $ver' package.json > package.json.tmp && \
  mv package.json.tmp package.json
pnpm install --no-frozen-lockfile

For npm-only directories (no pnpm), use .overrides only and run npm install.

3. Verify

npm audit 2>/dev/null | grep -i "${CVE_ID}" && echo "WARNING" || echo "CVE resolved"
# For pnpm web/:
grep -E "  ${PACKAGE}@" pnpm-lock.yaml | head -3
grep -q '^overrides:' pnpm-lock.yaml || { echo "ERROR: missing overrides: header"; exit 1; }

Output

Modified lockfiles in the specified directories. package.json only if overrides added.

---name: fix-nodedescription: Apply a Node.js dependency CVE fix via lockfile-only updates. Supports npm and pnpm. Uses overrides only as fallback when direct update is insufficient.---# Fix Node.js CVE## Inputs| Input | Required ||-------|----------|| `PACKAGE` | yes || `FIXED_VERSION` | yes || `CVE_ID` | yes || `REPO_DIR` | yes (cwd) || `NODEJS_DIRS` | default `.` `web/` || `USE_PNPM_WEB` | default false — set true when web/ uses pnpm || `PNPM_VERSION` | default `10` — CI pnpm major version |## Strategy1. Direct lockfile update first (sufficient for most transitive CVEs)2. Overrides in `package.json` only when update cannot reach fixed version3. Verify lockfile shows `package@<FIXED_VERSION>` before commit4. Do not commit `package.json` unless overrides were required## Steps### 1. Update each directoryFor each dir in `NODEJS_DIRS` with a `package.json`:```bashcd "${DIR}"if [ "$USE_PNPM_WEB" = true ] && [ "$DIR" = "web/" ]; then corepack prepare "pnpm@${PNPM_VERSION}" --activate rm -rf node_modules pnpm update "${PACKAGE}@${FIXED_VERSION}" --lockfile-only 2>/dev/null || \ pnpm update "${PACKAGE}" --lockfile-only 2>/dev/null || true npm update "${PACKAGE}" --package-lock-only 2>/dev/null || true # Fallback if lockfile-only update did not reach FIXED_VERSION: # python3 "${CLAUDE_PLUGIN_ROOT}/scripts/patch-pnpm-lock.py" web/pnpm-lock.yaml "$PACKAGE" "$OLD" "$FIXED" # Validate CI will accept the lockfile (do not use this to apply the bump): pnpm install --frozen-lockfileelse npm update "${PACKAGE}@${FIXED_VERSION}" 2>/dev/null || npm update "${PACKAGE}" 2>/dev/null || trueficd "$REPO_DIR"```### 2. Override fallbackIf lockfile version is still below `FIXED_VERSION`:```bashjq --arg pkg "$PACKAGE" --arg ver "${FIXED_VERSION}" \ '.overrides[$pkg] = $ver | .pnpm.overrides[$pkg] = $ver' package.json > package.json.tmp && \ mv package.json.tmp package.jsonpnpm install --no-frozen-lockfile```For npm-only directories (no pnpm), use `.overrides` only and run`npm install`.### 3. Verify```bashnpm audit 2>/dev/null | grep -i "${CVE_ID}" && echo "WARNING" || echo "CVE resolved"# For pnpm web/:grep -E " ${PACKAGE}@" pnpm-lock.yaml | head -3grep -q '^overrides:' pnpm-lock.yaml || { echo "ERROR: missing overrides: header"; exit 1; }```## OutputModified lockfiles in the specified directories. `package.json` only if overrides added.

Frequently asked questions

Fix Node