What problem does it solve? Freshly published package versions are a common supply-chain attack vector, and this Skill sets up dependency cooldowns that hold back new releases for a configurable period so compromised versions are caught before reaching your project. ## Core Features & Use Cases - Resolution site inventory: Scans the repository for every package manager, lockfile, CI workflow, Dockerfile, and update bot that resolves dependencies, so no unprotected install path is missed. - Per-manager configuration: Applies the correct cooldown setting for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, pixi, Bundler, Hex, mise, pinact, Renovate, Dependabot, and more, with version gates and per-package bypasses. - Verification and conflict detection: Reads settings back through each tool, runs dry-run resolutions, and detects environment variables or shell wrappers that silently override committed config. - Use Case: After a supply-chain incident, ask the agent to add a 3-day cooldown to a polyglot repo; it finds the npm, uv, and Dependabot resolution sites, writes the committed config, and verifies each gate holds back fresh versions. ## Quick Start Set up a 3-day dependency cooldown across every package manager and update bot in this repository.
