Avoid unpinned npm install example that triggers supply-chain warnings

[R7038XX]

Summary

skills/i-have-adhd/SKILL.md currently uses an unpinned package installation as the positive example for the "Lead with the next action" rule:

Good: "Run `npm install jsonwebtoken`, then edit `src/auth.ts:42`."

When installing the skill through Hermes Agent, its security scanner reports this line as a MEDIUM supply-chain finding (unpinned_npm_install). The overall skill is still classified as SAFE, so this is not suggesting the skill itself is malicious.

However, installing jsonwebtoken is only part of an illustrative example and is not required for the skill's functionality.

Proposal

Replace the dependency-install example with an action-first example that does not download a third-party package, for example:

Good: "Edit `src/auth.ts:42` to update the token validation."

This keeps the intent of the rule intact:

• the response begins with a concrete action;
• the relevant path is immediately visible;
• there is no explanatory preamble;
• no unnecessary dependency installation is introduced into the example.

Why remove the install example instead of pinning a version?

A pinned command such as npm install --save-exact jsonwebtoken@<version> would reduce the specific unpinned-install concern, but it would also couple the documentation to a package version that can become outdated.

Since jsonwebtoken is not part of the skill's functionality, removing the dependency-install example seems simpler and more future-proof.

Related occurrences

Similar examples also appear elsewhere in the repository, including:

• README.md, which uses npm install jsonwebtoken@latest;
• .cursor/skills/i-have-adhd/SKILL.md;
• translated README files.

If those files are generated or synchronized from another source, they could be regenerated rather than edited independently.

Expected result

• The behavior and intent of the skill remain unchanged.
• The specific unpinned_npm_install finding caused by this example should no longer be triggered.
• Documentation no longer recommends an unnecessary moving or unpinned dependency installation.
• Equivalent examples can stay consistent across supported integrations and translations.

This proposal is limited to the example wording and does not add new security rules or change the scope of the skill.