dependency-audit SKILL.md skillA
dependency-audit from perrylink/dsh-skill-pack-security is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add perrylink/dsh-skill-pack-security/dependency-audit@v2.2.25Pins v2.2.25 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- perrylink/dsh-skill-pack-security
- Path
skills/dependency-audit/SKILL.md- Versions recorded
- 13
- Latest version
- v2.2.25, committed Oct 31, 2026
- First version recorded
- Sep 7, 2026
- Size
- 8,312 bytes
- Repository stars
- 22
- License
- Apache-2.0
依赖供应链审计：pnpm/npm audit 输出与退出码解读、license 与投毒风险检查清单、锁文件漂移检测命令。任务要求审计项目依赖的已知漏洞、许可证风险、可疑包或 lockfile 一致性并出结论时用；单独安装/升级某个依赖或纯功能开发不展开本流程。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 依赖审计（dependency-audit）
目标：对仓库依赖面给出**每条结论都附命令证据**的审计结果。输出分七块：已知漏洞、license、投毒风险、锁文件漂移、多生态漏洞、SBOM 清单、provenance/签名。
## 自动化预检：plugin_vet 工具
`plugin_vet` 已自动执行本技能第 3/4/7 节的静态部分（license 判定、投毒清单、SBOM 依赖树），其结果逐条引用本技能小节编号。自动化命中后，按各节命令复核证据并排除误报。
## 1. 定位包管理器与锁文件
```sh
git ls-files -- 'package.json' 'pnpm-lock.yaml' 'package-lock.json' 'yarn.lock' 'bun.lockb' 'npm-shrinkwrap.json'
node --version; pnpm --version
osv-scanner --version
```
样例输出（pnpm 仓库）：`package.json` 与 `pnpm-lock.yaml` 各一行。
判据：锁文件决定后续命令族（pnpm→第 2 节，npm→同节 npm 变体）；**多个锁文件并存 = 仓库异常**，写进发现；版本号写进报告（audit 数据随 registry 与工具版本变化）；`osv-scanner` 不可用只影响第 6 节，注明即可。
## 2. 已知漏洞：pnpm audit
```sh
pnpm audit --prod --json > audit.json; echo $LASTEXITCODE
```
（bash 用 `$?`；PowerShell 用 `$LASTEXITCODE`。）
- 退出码：0 = 无已知漏洞；非 0 = 有漏洞 **或 registry 不可达**（stderr 含 `fetch`/`ECONNREFUSED`/`ETIMEDOUT` 时为网络失败，不是发现漏洞——重试后再说）。
- `--prod` 只审生产依赖；需要全量视图时补跑 `pnpm audit --json`，devDependencies 部分按下文的降档规则处理。
- 输出样例（`advisories` 是按 advisory id 键控的**对象**，下例为其一个值；字段以实际输出为准）：
```json
{ "id": "GHSA-xxxx-yyyy-zzzz", "severity": "high",
"module_name": "example-lib", "vulnerable_versions": "<2.3.0",
…Read the whole file at its exact version.
How to install
mdr add perrylink/dsh-skill-pack-security/dependency-audit@sha256:262b92afa113d8b1The line at the top of this page pins the label v2.2.25, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_5noofevnldmyjae2)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 13 versions of this file, between Sep 7, 2026 and Oct 31, 2026, about one every 5 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.2.25 latest | 2026-10-31 | af6b35f | 8,312 B | A | view · diff |
| v2.2.24 | 2026-10-10 | 0c1deb8 | 8,312 B | A | view · diff |
| v2.2.23 | 2026-10-10 | a5f8d45 | 8,312 B | A | view · diff |
| v2.2.22 | 2026-10-05 | 008bf2e | 8,312 B | A | view · diff |
| v2.2.20 | 2026-10-05 | 6b2adfe | 8,312 B | A | view · diff |
| v2.2.19 | 2026-10-04 | 380880e | 8,312 B | A | view · diff |
| v2.2.18 | 2026-10-04 | 8761f0d | 8,312 B | A | view · diff |
| v2.2.17 | 2026-09-24 | f926448 | 8,312 B | A | view · diff |
| v2.2.16 | 2026-09-12 | 8e74c4d | 8,312 B | A | view · diff |
| v2.2.14 | 2026-09-10 | d6120c8 | 8,312 B | A | view · diff |
| v2.2.13 | 2026-09-09 | 6ffdda7 | 8,312 B | A | view · diff |
| v2.2.12 | 2026-09-09 | dd3da11 | 8,312 B | A | view · diff |
| v2.2.10 | 2026-09-07 | 4430c52 | 8,312 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8312 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
perrylink/dsh-skill-pack-security · 22 stars · license Apache-2.0 · pushed 2026-11-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_5noofevnldmyjae2 GET https://markdownregistry.com/api/v1/resolve?ref=perrylink/dsh-skill-pack-security/dependency-audit GET https://markdownregistry.com/api/v1/blob/262b92afa113d8b11a740c041043362ed614c64b68872afedff0355dfd05df46
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from perrylink/dsh-skill-pack-security
Every file in perrylink/dsh-skill-pack-security