agentleFS
Sign inStart free
NikoxkxNikoxkx/Agent-Skills/skills/security/dependency-checker/SKILL.md

dependency-checker

Skill1 starsChanged 5 months agoApache-2.0View on GitHub

Audits third-party dependencies for known vulnerabilities, license issues, and supply chain risks. Use when reviewing dependencies before merging or deploying.

1 other project uses a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

6 rules. About 0 are common, 6 are distinctive, and 0 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈6

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Before merging a PR that updates or adds dependencies.

    line 19
  2. Distinctive:

    After a high-profile supply chain attack (log4shell, etc.).

    line 22
  3. Distinctive:

    Check for typosquatting (similar names to popular packages).

    line 46
  4. Distinctive:

    Prefer exact pins in lockfiles (they are).

    line 49
  5. Distinctive:

    Update + test + merge (or defer with justification).

    line 61
  6. Distinctive:

    No patch available: Use mitigation (e.g., network controls, input sanitization) + monitor for fix.

    line 77

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Overview

Audits third-party dependencies for vulnerabilities (SCA), problematic licenses, and supply chain risk indicators. Covers npm audit, pip-audit, cargo audit, license checkers (FOSSA, license-checker, pip-licenses), dependency graph analysis, Dependabot/Renovate setup, pinning vs ranges, and a weekly dependency review workflow.

When to Use This Skill

  • Before merging a PR that updates or adds dependencies.
  • As part of release preparation.
  • Regularly (weekly or per sprint) as hygiene.
  • After a high-profile supply chain attack (log4shell, etc.).

Prerequisites

  • The project's lockfile(s) and manifest(s) (package-lock.json, yarn.lock, poetry.lock, Cargo.lock, etc.).
  • Access to vulnerability databases (tools query them).

Steps

  1. Vulnerability scanning:
    • Node: npm audit (or pnpm audit, yarn audit).
    • Python: pip-audit or safety.
    • Go: go list -m -json all | nancy sleuth or govulncheck.
    • Rust: cargo audit.
    • General: Snyk, Dependabot alerts, GitHub Dependabot.
  2. License auditing:
    • license-checker --production --onlyAllow "MIT;Apache-2.0;BSD" (Node).
    • pip-licenses --allow-only="MIT;Apache-2.0" (Python).
    • FOSSA or Snyk License for larger orgs.
  3. Supply chain signals:
    • Maintainer count, last publish date, download count, provenance (sigstore, etc.).
    • Tools like socket.dev or deps.dev give risk scores.
    • Check for typosquatting (similar names to popular packages).
  4. Pinning & ranges:
    • Prefer exact pins in lockfiles (they are).
    • In manifests: use ^ / ~ carefully; document policy (e.g., "patch and minor auto, major manual").
    • For critical security deps, pin more tightly.
  5. Automation:
    • Dependabot or Renovate for automated PRs (group updates, auto-merge for patch/minor after CI).
    • Require security review for major or high-risk updates.
  6. Weekly review workflow:
    • Review open Dependabot PRs.
    • Run full audit.
    • Prioritize by severity + reachability.
    • Update + test + merge (or defer with justification).
  7. Output:
    • Exact audit commands for the languages in the project.
    • Sample report interpretation.
    • Recommended Dependabot / Renovate config.
    • License allow-list policy.
    • Dependency review checklist for PRs.

Examples

A complete weekly dependency review process for a Node + Python monorepo, including audit commands, a sample Dependabot config that groups security updates, license policy, and a PR template for dependency updates is included.

Edge Cases & Error Handling

  • Transitive vulnerabilities: Most tools surface them; focus effort on direct deps you can actually change.
  • No patch available: Use mitigation (e.g., network controls, input sanitization) + monitor for fix.
  • License conflicts: Legal review for copyleft in certain contexts.

Verification

  1. Full audit runs cleanly or with only accepted/low findings.
  2. License check passes against the allow-list.
  3. Dependabot/Renovate is configured and creating PRs.
  4. A known vulnerable dependency (intentionally added) is detected and a fix PR is opened.
  5. Success: The project has a repeatable process that keeps dependencies reasonably current and free of critical known vulnerabilities and problematic licenses.

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free