# Missing or Ignored Dependency Lockfile

> Detects projects where lockfiles are missing or ignored in version control, allowing non-deterministic builds with potentially different dependency versions.

- Skill: `zakirkun/missing-or-ignored-dependency-lockfile` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/missing-or-ignored-dependency-lockfile`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/missing-or-ignored-dependency-lockfile/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/missing-or-ignored-dependency-lockfile

---


# Missing or Ignored Dependency Lockfile

## Overview
Lockfiles (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `go.sum`, `Gemfile.lock`) pin exact dependency versions. Without them, `npm install` may install newer versions that introduce vulnerabilities or malicious code.

Gitignoring lockfiles in application projects is a security anti-pattern.

## Remediation
- Commit lockfiles to version control for all application projects
- Use `npm ci` instead of `npm install` in CI/CD
- Verify lockfile integrity in CI with `--frozen-lockfile`