npm Audit Fix Loop
A dependency-security loop that avoids blindly running `npm audit fix --force` and instead ties remediation to build and test evidence.
Use loop copies the kickoff prompt. Copy Markdown and Download loop include the complete Markdown page with context, source attribution, anchors, and guardrails. Cursor / Claude Code buttons prepare the shorter kickoff prompt only.
Supported agents
Goal
Remediate actionable vulnerabilities without unsafe forced upgrades.
Feedback gate
npm audit --audit-level=highStop condition
No high/critical audit findings remain, or remaining findings are documented with blockers.
Give the agent these inputs before it starts the loop. This keeps discovery bounded and prevents vague retries.
The loop assumes these commands or integrations are available. Missing tools should be reported as blockers, not ignored.
Two separate pieces: the kickoff prompt starts the loop, while the downloaded Markdown carries the complete reference page.
1. Copy or download
Use the kickoff for a fast agent run. Download the full Markdown when you need source, context, and attribution in one file.
2. Paste into the agent
Start a fresh agent session in the target repo and provide the requested project context if the loop asks for it.
3. Let it self-pace
The agent should act, check evidence, retry only when the gate fails, and stop at the stated exit condition.
The diagram shows the order. This checklist keeps only the action, command, and failure handling needed during a real pass.
1. Run audit
Capture current high/critical vulnerabilities.
npm audit --audit-level=high2. Review remediation paths
Prefer safe minor/patch updates before force upgrades.
3. Apply updates
Update targeted dependencies and lockfile.
4. Verify app
Run build/tests after updates.
pnpm buildThis is the text copied by Use loop. It is intentionally shorter than the Markdown export.
Run audit, review safe remediation paths, update targeted dependencies, verify build/tests, and report remaining vulnerability risk.
Goal: Remediate actionable vulnerabilities without unsafe forced upgrades.
Check command: npm audit --audit-level=high
Exit condition: No high/critical audit findings remain, or remaining findings are documented with blockers.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not run force upgrades without explaining breaking-change risk and receiving approval.Quality
88/100
Safety
89/100
Expected output
Audit result delta, changed dependencies, and build/test evidence.
Related loops
Browse allDependency Upgrade Safety Loop
Upgrade dependencies in small batches, inspect install scripts, and verify build/test behavior after each batch.
Kickoff preview
Upgrade dependencies in small safe batches, review install-time scripts, run build/tests after each batch, and document remaining breaking changes. Goal: Upgrade dependencies without breaking the app or ignoring supply-chain risk. Check command: pnpm build Exit condition: Selected dependency batch is upgraded and validation passes. Max iterations: 5 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not blindly install packages without reviewing install/postinstall/prepare scripts.
Pre-Commit Guard
Before committing, run diff hygiene, secrets checks, and the closest validation command.
Kickoff preview
Before committing, inspect the staged diff, scan for secrets/debug flags, run relevant validation, and only commit if the guard passes. Goal: Block commits that contain secrets, debug switches, or unverified broken code. Check command: git diff --cached --check Exit condition: Staged diff is clean, no obvious secrets/debug flags are present, and relevant validation passes or is explained. Max iterations: 3 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not commit secrets, local env files, debug flags, or generated private artifacts.
Secret Leak Scan Loop
Scan repository changes for leaked credentials, local env files, and unsafe debug output before publishing.
Kickoff preview
Scan changed and staged files for secrets, local env files, and debug leaks. Remove or redact unsafe values and repeat until clean. Goal: Prevent secrets and local credentials from leaving the working tree. Check command: git diff --cached | rg -n "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA|BEGIN OPENSSH)" Exit condition: No unapproved secrets or local credentials are present in staged or changed files. Max iterations: 4 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Never print raw secrets in the final answer. Redact values if they appear in output.
Ship PR Until Green
Implement a scoped change, open or update a pull request, inspect CI, and continue until all required PR checks pass.
Kickoff preview
Take this branch to a green pull request. Implement the requested change, run local verification, open or update the PR, run `gh pr checks`, inspect failures, fix root causes, and repeat until every required check passes or you hit the iteration cap. Goal: Open or update a pull request and stop only when all required PR checks are green. Check command: gh pr checks Exit condition: All required pull request checks are successful and the PR is ready for review or merge. Max iterations: 10 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not disable required checks, edit loops to skip jobs, or remove tests to make CI green. - Do not merge the PR unless the user explicitly asked for merge authority.