skills.rest
SgtPooki
SgtPookiCOMMUNITY
Explore all skills by this author →
Website𝕏@SgtPookiGitHub

dep-verify

Audits dependency-update PRs for compatibility and supply-chain integrity before merging.

1|Updated Mar 24, 2026
Search Tags:#provenance#semver#dependency audit#supply chain security#dependabot#lockfile#pull request review
One-click install
npx skills add https://github.com/SgtPooki/skills --skill dep-verify-sgtpooki
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-verify
Source: https://github.com/SgtPooki/skills/tree/main/skills/dep-verify
Command: npx skills add https://github.com/SgtPooki/skills --skill dep-verify-sgtpooki

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Dependency-update PRs from Dependabot or Renovate look trivial, but green CI proves neither compatibility nor safety — roughly a third of releases ship breaking changes, and major supply-chain attacks (event-stream, xz, chalk/debug, Shai-Hulud) all arrived as ordinary version bumps. This Skill performs a full pre-merge audit so a human can merge with evidence instead of trust. ## Core Features & Use Cases - Two-axis audit: Checks compatibility (changelogs across every intermediate version, published-artifact diffs, packaging metadata, blast radius in your codebase, build/typecheck/tests) and supply-chain integrity (release-age cooldowns, provenance/signatures, publisher continuity, lockfile tampering, advisory and malware feeds). - Any ecosystem: Covers npm/pnpm/yarn, GitHub Actions, Docker, Go, Python, Rust, Ruby, Java, and .NET with ecosystem-specific commands in references. - Verdict report: Produces a structured MERGE / MERGE WITH CAUTION / HOLD / REJECT report with evidence, findings, and an explicit list of what was not verified. It never merges, approves, or comments on the PR. - Use Case: Point it at a Dependabot PR bumping a production npm package; it verifies the bot author is authentic, diffs the published tarballs, checks the release is past the 3-day cooldown, reviews the lockfile diff, maps usage sites in your code, runs the test suite, and reports a verdict. ## Quick Start Ask the agent to audit a dependency-update PR, for example: "Review this Dependabot PR and tell me if it's safe to merge: https://github.com/owner/repo/pull/123".

Frequently Asked Questions about dep-verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Dependabot PR before merging?▼

Point the audit at the PR URL or owner/repo#number. It verifies the author is the real Dependabot app account with verified commits, diffs the published artifact between versions, checks release age against a 3-day cooldown, reviews the lockfile diff, and runs your build and tests before issuing a verdict.

How to check if a package update has breaking changes?▼

The audit reads release notes for every intermediate version, diffs the published artifacts (e.g. npm diff), and compares packaging metadata like exports maps, engines, and peer dependencies. It then maps the changed APIs against actual usage sites in your codebase to name affected files and functions.

Does dependency auditing work for ecosystems other than npm?▼

Yes, it covers GitHub Actions, Docker images, Go modules, Python (PyPI), Rust crates, Ruby, Java, and .NET with ecosystem-specific commands. The same check categories apply universally: artifact diff, publish timestamp, provenance, frozen install, and dependency-tree explanation.

Can this skill merge or approve the pull request automatically?▼

No, it never merges, approves, or comments on the PR. The deliverable is a verdict report (MERGE, MERGE WITH CAUTION, HOLD, or REJECT) with evidence and recommended next steps; the human performs the merge.

Why is a brand-new package release flagged as risky?▼

Malicious releases are typically detected and pulled within hours to days, so a release under 3 days old gets at best a MERGE WITH CAUTION verdict with an explicit safe-after date. Security fixes are the exception, where CVE severity is weighed against freshness.

What supply-chain red flags does the audit detect?▼

It flags new install scripts, artifact divergence from the git repo, young low-download dependencies, maintainer ownership changes, obfuscated code, new network or filesystem capabilities, binary blobs, provenance regressions, and lockfile anomalies like off-registry URLs or hash downgrades.

Related Skills

Explore More Software Engineering Skills→
sluongngsluongng
6

github-create-pr

Draft and open GitHub pull requests from a local branch.

Community
Advanced
zeroclaw-labszeroclaw-labs
32.7k

wit-breaking-change-check

Classifies WIT interface diff changes as breaking or non-breaking against frozen version markers.

Official
Intermediate
phrazzldphrazzld
13

org-quality-governance

Enforce organizational quality and security policies across repositories.

Community
Advanced
lklimeklklimek
1

dependabot-merge

Audit and conditionally merge Dependabot pull requests based on CI status.

Community
Advanced