skills.rest
ZaxbyHub
ZaxbyHubOFFICIAL
Explore all skills by this author →
GitHub

reviewing-dependencies

Validate dependencies, imports, and lockfiles against canonical package registries for hallucinations and mismatches.

Updated Mar 30, 2026
Search Tags:#code review#package validation#supply chain security#typosquatting#lockfile#dependency review#registry verification
One-click install
npx skills add https://github.com/ZaxbyHub/ragappv3 --skill reviewing-dependencies-zaxbyhub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reviewing-dependencies
Source: https://github.com/ZaxbyHub/ragappv3/tree/main/.claude/skills/reviewing-dependencies
Command: npx skills add https://github.com/ZaxbyHub/ragappv3 --skill reviewing-dependencies-zaxbyhub

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI-generated code and rapid dependency changes can introduce phantom packages, hallucinated versions, typosquatting risks, and undeclared runtime tools that break installs or open supply-chain attack vectors. This Skill systematically checks every dependency claim against the canonical registry before it reaches production. ## Core Features & Use Cases - Registry Verification: Confirms each package and pinned version exists in the correct ecosystem's canonical registry. - Mismatch Detection: Flags import/install name differences, cross-ecosystem confusion, manifest-lockfile drift, and imports missing from manifests. - Slopsquatting Defense: Flags suspicious generic names like *-utils or fast-* that are newly published or low-signal. - Use Case: After an AI assistant adds requests-wrapper==2.1.0 to your requirements.txt, run this review to discover the package does not exist on PyPI and the import actually maps to a different install name. ## Quick Start Review the dependency changes in this pull request and verify every new package and pinned version against its canonical registry.

Frequently Asked Questions about reviewing-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a package name is hallucinated by an AI?▼

Verify the package name directly in the canonical registry for its ecosystem, such as PyPI for Python or npm for JavaScript. If the package is not found there, it is a phantom package and should be treated as a hard failure before merging.

How to detect typosquatting and slopsquatting in dependencies?▼

Flag suspicious generic names like *-utils, *-helper, fast-*, or *-wrapper, especially when newly published or low-signal. Compare names against well-known packages and check registry trust signals before accepting them.

What is cross-ecosystem dependency confusion?▼

It occurs when a package name valid in one ecosystem is installed from another, such as confusing a PyPI package with an npm package of the same name. This breaks installation or runtime and is flagged as a hard fail condition.

Why does my import name differ from the install package name?▼

Some packages install under one name but import under another, which is legitimate when handled correctly. The review verifies the project maps import names to install names properly and flags unhandled mismatches.

When should manifest changes also update the lockfile?▼

Whenever a project uses a lockfile, any manifest change must be reflected in it. A manifest change without a corresponding lockfile update is flagged because it causes inconsistent or unreproducible installs.

Related Skills

Explore More Software Engineering Skills→
SavigeSystemZSavigeSystemZ

dependency-review

Identify and analyze dependency changes across manifests and lockfiles.

Official
Intermediate
haJ1thaJ1t

supply-chain-verifier

Audit software dependencies for vulnerabilities, provenance, and license compliance.

Community
Advanced
utsavthakurutsavthakur

dependency-confusion

Detect package dependency confusion conflicts between private and public registries.

Community
Advanced
arinhubcomarinhubcom

ah-submit-code-review

Submit structured code reviews to GitHub pull requests with inline comments.

Official
Advanced