dsh-dependency-audit
Skill4 starsChanged 3 months agoMITView on GitHub
升级或审查项目依赖时使用：审计安全告警、控制安装脚本风险、制定升级回滚预案。
In this repository18 other files it gives its agents.
- dsh-changelogSkill
- dsh-chinese-docsSkill
- dsh-code-reviewSkill
- dsh-debug-sessionSkill
- dsh-doc-syncSkill
- dsh-git-commitSkill
- dsh-office-artifactsSkill
- dsh-plugin-clientSkill
- dsh-plugin-devSkill
- dsh-plugin-i18nSkill
- dsh-plugin-publishSkill
- dsh-preset-authoringSkill
- dsh-pr-reviewSkill
- dsh-refactor-safeSkill
- dsh-skill-adapterSkill
- dsh-task-breakdownSkill
- dsh-test-firstSkill
- dsh-webapp-testingSkill
The file
Files
依赖审计与升级
安装前的底线
- 安装依赖 = 运行第三方代码；
postinstall/prepare脚本尤其要读一遍 - 优先官方源/镜像：
npm_config_registry=https://registry.npmmirror.com（国内网络）
审计
npm audit # 或 pnpm audit
npm outdated # 看哪些落后- 锁文件必须提交（package-lock.json / pnpm-lock.yaml），保证可复现
- 审计告警分级处理：生产路径的高危项立即处理，开发依赖的低危项排期
升级流程
- 读目标版本 CHANGELOG，确认破坏性变更
- 升级 → 全量跑测试
- 失败回滚：锁文件与依赖版本一起回退
- 升级与功能改动分提交
减依赖
新增依赖前先问：标准库能否实现？能否延迟到真正需要时再引入？
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.