
Security News
GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.
@deppon/deppon-skills
Advanced tools
Cursor Agent Skills for @deppon/* (ProForm, ProTable, PRD, private npm workflow)
@deppon/deppon-skills本仓库维护的 Cursor Agent Skills(SKILL.md 集合),用于对齐 @deppon/deppon-template、@deppon/deppon-ui 等私有 npm 包的前端生成与 PRD 流程。
.cursor/skills/<name>/SKILL.md 加载技能。node_modules 读 skill,因此安装本 npm 包后需要执行一次安装脚本(见下文)。在 deppon-npm 根目录维护 .cursor/skills/;npm pack / npm publish 前会通过 prepack → npm run build 将其中内容复制到包内 dist/:
cd packages/deppon-skills
npm run build # 可选手动执行;prepack 会再次执行
npm pack
npm run publish:auto # 等同 npm publish,需已登录 publishConfig 中的私有 registry
版本可与 monorepo 一起做 lerna 发布,或单独改本包 version 后 npm run publish:auto。
npm install @deppon/deppon-skills -D
dist/ 下各 skill 目录复制到当前项目:npx deppon-skills-install
会在当前目录创建/覆盖 .cursor/skills/*。
@deppon/deppon-template 等,参见 skill deppon-npm-private-registry。升级 @deppon/deppon-skills 后重新执行:
npx deppon-skills-install
若在 monorepo 内直接维护 .cursor/skills 而不通过 npm,则无需安装本包。
FAQs
Cursor Agent Skills for @deppon/* (ProForm, ProTable, PRD, private npm workflow)
We found that @deppon/deppon-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.