Package lock parsing

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-haiku-4-5/dependency-vulnerability-check/package-lock-parsing

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill package-lock-parsing

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Parse and extract package information from npm package-lock.json files to identify dependencies and their installed versions.

SKILL.md

1.9 KB, as published. Nobody here has run it

Package-lock.json Parsing

Overview

The package-lock.json file is an npm lock file that records exact dependency versions used in a project. It enables reproducible installs and is essential for vulnerability scanning.

File Structure

The package-lock.json follows this structure:

{
  "name": "project-name",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "packages": {
    "": {
      "name": "project-name",
      "version": "1.0.0",
      "dependencies": {
        "express": "^4.18.0"
      }
    },
    "node_modules/express": {
      "version": "4.18.2",
      "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz"
    }
  }
}

Key Properties

packages: Contains all packages (root + node_modules)
version: The installed version of each package
dependencies: Direct dependencies of a package

Extraction Pattern

import json

def parse_package_lock(file_path):
    with open(file_path, 'r') as f:
        lock_data = json.load(f)

    packages = {}
    for pkg_path, pkg_info in lock_data.get('packages', {}).items():
        # Skip root package
        if pkg_path == '':
            continue

        pkg_name = pkg_path.split('/')[-1]
        version = pkg_info.get('version')
        packages[pkg_name] = version

    return packages

Usage

Use this skill when:

Extracting dependency lists from package-lock.json
Building vulnerability scanning pipelines
Analyzing dependency versions for compliance
Creating inventory reports of installed packages

Related Skills

trivy-vulnerability-scanning: Use parsed packages as input to vulnerability scanner
security-audit-csv-reporting: Output results in structured CSV format