Use when reviewing a project's security posture, setting up CI pipelines, or responding to a reported vulnerability in a dependency.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Audit dependencies for known vulnerabilities
Third-party packages are the most common attack surface in modern web applications. The 2021 Log4Shell incident, the 2022 node-ipc supply-chain attack, and countless npm package hijackings demonstrate that a single vulnerable transitive dependency can compromise every application that depends on it. Automated, continuous scanning drastically reduces the window between a CVE being published and your team being aware of it.
## Quick Reference
- Run pnpm audit (or npm audit) before every production deployment
- Integrate automated dependency scanning in CI (GitHub Dependabot or Snyk)
- Treat critical and high severity findings as release blockers
- Pin transitive dependencies with a lock file committed to version control
## Check
Check the project's dependencies for known security vulnerabilities using the package manager audit command.
## Fix
Upgrade, patch, or replace vulnerable dependencies and configure automated scanning in the CI pipeline.
## Explain
Explain how supply-chain attacks work and why dependency auditing is a critical part of modern application security.
## Code Review
…
The line at the top of this page pins the label git:20261004.4b0ddb9, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_uoe7czujx7yggjik
GET https://markdownregistry.com/api/v1/resolve?ref=thedaviddias/front-end-checklist/dependency-audit
GET https://markdownregistry.com/api/v1/blob/6573a2ac7ec8762215e3f14e105c50a947cdf666d88b9b52e78ead259809e8e9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
thedaviddias/front-end-checklist · packages/cli/SKILL.md · Review frontend code and live pages against the Front-End Checklist (380+ rules for accessibility, performance, SEO…
thedaviddias/front-end-checklist · plugins/front-end-checklist/skills/frontend-checklist-global/SKILL.md · Use when auditing or improving any frontend codebase against the full Front-End Checklist rule corpus through one entry…
thedaviddias/front-end-checklist · skills/404-page/SKILL.md · Use when reviewing templates, rendered HTML, or shared components related to Create a custom 404 error page. Validate…
thedaviddias/front-end-checklist · skills/about-page/SKILL.md · Use when auditing metadata, crawlability, structured data, or indexability related to Create a dedicated About page…
thedaviddias/front-end-checklist · skills/accessibility-testing/SKILL.md · Use when reviewing component libraries, page flows, or CI pipelines that need repeatable accessibility checks…
thedaviddias/front-end-checklist · skills/accessible-authentication/SKILL.md · Use when reviewing sign-in, sign-up, MFA, CAPTCHA, recovery, and re-auth flows. Evaluate the full authentication path…
thedaviddias/front-end-checklist · skills/accessible-notifications/SKILL.md · Use when reviewing templates, rendered HTML, or shared components related to Make notifications accessible. Validate…
thedaviddias/front-end-checklist · skills/accessible-tables/SKILL.md · Use when reviewing rendered HTML, interactive components, or design-system patterns related to Use semantic table…
thedaviddias/front-end-checklist · skills/accessible-tooltips/SKILL.md · Use when reviewing templates, rendered HTML, or shared components related to Create accessible tooltips. Validate the…
thedaviddias/front-end-checklist · skills/accesskeys/SKILL.md · Use when reviewing rendered HTML, interactive components, or design-system patterns related to Ensure accesskey values…
apache/magpie · plugins/magpie-repo-health/skills/dependency-audit/SKILL.md · Read-only dependency vulnerability audit for one repository or a local
checkout. Detects the project's dependency…
fusengine/agents · plugins/security-expert/skills/dependency-audit/SKILL.md · Use when running ecosystem-specific vulnerability scans across project dependencies (npm/composer/pip/cargo/go/etc)…
