Use this skill before adding a dependency, when an audit or Dependabot alert fires, or when a lockfile changes in a review - triaging CVEs by real reachability, spotting typosquats and install scripts, pinning and lockfile discipline, and license checks. Covers deciding what actually needs fixing instead of chasing every advisory to zero.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Dependency audit and supply chain
Two failures, opposite directions: shipping a package nobody vetted (install script,
typosquatted name, unmaintained transitive dep), and burning a day on advisories
that are unreachable in this app. Both come from not asking *is this reachable, and
what does it cost to remove*.
## When to activate
- Before `npm i <new-package>` (or pip/go/cargo/composer equivalent).
- `npm audit` / Dependabot / Snyk / GitHub alert, or a CI security job failing.
- A PR whose diff includes a lockfile.
- Post-incident: "was this package the way in?"
## Adding a dependency — the 60-second vet
1. **Do you need it?** Platform first: `Intl`, `URL`, `fetch`, `crypto.subtle`,
`structuredClone`, CSS `:has`. A 3-line helper beats a transitive tree.
2. **Is the name right?** Typosquats live one character away
(`react-domm`, `lodash.js`, `crossenv`, `discord.js-selfbot`). Copy the name from
the official docs, never from a model's memory or a blog post.
3. **Is it alive?** Last publish, open-issue trend, maintainer count, downloads.
One maintainer + last release three years ago = you are adopting the code.
…
The line at the top of this page pins the label git:20260816.37028bb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_6vcmtpfzt43x46pj
GET https://markdownregistry.com/api/v1/resolve?ref=chadixearth/graphyloop/dependency-audit
GET https://markdownregistry.com/api/v1/blob/6ac0e5ad3ff2c3091a374bb9ea4be515421ae229b0a98f6763fd54f7e1541ecd
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
chadixearth/graphyloop · integrations/claude-code/skills/graphyloop-waves/SKILL.md · Use this skill when a request spans more than one layer (database + backend + frontend, or a feature plus a data…
chadixearth/graphyloop · integrations/claude-code/skills/graphyloop-workflow/SKILL.md · Use this skill at the start of any non-trivial coding task, build or multi-file change to follow GraphyLoop Workflow v3…
chadixearth/graphyloop · integrations/claude-code/skills/swarm-memory/SKILL.md · Use this skill at the start and end of every non-trivial task to recall and record durable project knowledge through…
chadixearth/graphyloop · skills/ai-video-prompt-engineer/SKILL.md · Use when the user wants to create AI video generation prompts for a brand, product, website, or topic. Includes…
chadixearth/graphyloop · skills/api-contract-design/SKILL.md · Use this skill when freezing the interface between a backend and its clients before parallel work starts, or when…
chadixearth/graphyloop · skills/api-hardening/SKILL.md · Use this skill when building or reviewing a server-side endpoint, route handler, server action, webhook, cron job, or…
chadixearth/graphyloop · skills/brainstorming/SKILL.md · You MUST use this before any creative work - creating features, building components, adding functionality, or modifying…
chadixearth/graphyloop · skills/cavecrew/SKILL.md · Decision guide for delegating to caveman-style subagents. Tells the main thread WHEN to spawn `cavecrew-investigator`…
chadixearth/graphyloop · skills/caveman-compress/SKILL.md · Compress natural language memory files (CLAUDE.md, todos, preferences) into caveman format to save input tokens…
thedaviddias/front-end-checklist · skills/dependency-audit/SKILL.md · Use when reviewing a project's security posture, setting up CI pipelines, or responding to a reported vulnerability in…
apache/magpie · plugins/magpie-repo-health/skills/dependency-audit/SKILL.md · Read-only dependency vulnerability audit for one repository or a local
checkout. Detects the project's dependency…
fusengine/agents · plugins/security-expert/skills/dependency-audit/SKILL.md · Use when running ecosystem-specific vulnerability scans across project dependencies (npm/composer/pip/cargo/go/etc)…
