Claude Code Skills Help Developers Safely Automate PHP and JS Dependency Updates

A developer has built Claude Code 'skills' — markdown instruction files — to enforce strict safety rules when AI agents handle package updates in TypeScript and Laravel PHP projects. The approach was prompted by a string of supply chain attacks in 2025, including compromised npm packages chalk and debug, the self-propagating Shai-Hulud worm, and an Nx exploit that hijacked local AI coding tools to steal credentials. The safety workflow requires the agent to first research supply chain incidents from the past six months, audit all dependencies, and assign each package a verdict before any update proceeds. A key rule bars installation of any package version less than seven days old, since malicious releases are typically caught and removed within hours. The author argues that encoding these checks into reusable agent skills ensures consistent, fatigue-free enforcement every time an update is run.