How do I install the Lockfile Doctor skill?

Run npx skillmds@latest add starr-del/lockfile-doctor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Lockfile Doctor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Lockfile Doctor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Lockfile Doctor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Lockfile Doctor?

Starr-del (@starr-del) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Lockfile Doctor by starr-del — Agent Skill

Name: Lockfile Doctor
Author: Starr-del

Lockfile Doctor

Diagnose package-manager and lockfile drift that causes 'works on my machine' deploy failures. Use whenever an install behaves differently in CI than locally, the user mentions lockfile conflicts, npm/pnpm/yarn confusion, 'npm ci failed', non-reproducible builds, or when auditing any Node project before deploy. Runs fully offline — no API keys, no network, no credentials.

Starr-del be1dbc9 2 files · 7.6 KB Updated Sep 17, 2026

File contents

lockfile-doctor

Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

python3 scripts/lockfile_doctor.py <project_root> [--json]

Checks: multiple coexisting lockfiles (platform picks one, devs use another), missing lockfile entirely, packageManager field disagreeing with the committed lockfile, missing engines.node, and fragile dependency specs — git branches, file: paths that won't exist on the build machine, and */latest wildcards.

The mental model to give the user: a deploy is reproducible only if the same package manager, same Node version, and same lockfile produce the same node_modules everywhere. Each finding is one of those three legs broken.

When MULTIPLE_LOCKFILES fires, help the user pick ONE manager (whichever the team actually uses), delete the other lockfiles, and gitignore them so they don't return.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (lockfile-doctor/).

Frequently asked questions