skills.rest
htxryan
htxryanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

Security Deps Specialist

Audits dependency changes for vulnerabilities, lockfile tampering, and supply chain risks.

1|Updated Apr 25, 2026
Search Tags:#code review#npm audit#dependency audit#cve#supply chain security#pip-audit#lockfile analysis
One-click install
npx skills add https://github.com/htxryan/claude-code-config-profiles --skill security-deps-specialist-htxryan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Security Deps Specialist
Source: https://github.com/htxryan/claude-code-config-profiles/tree/main/.agents/skills/compound/agents/security-deps
Command: npx skills add https://github.com/htxryan/claude-code-config-profiles --skill security-deps-specialist-htxryan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Dependency updates can silently introduce vulnerable packages, malicious postinstall scripts, or tampered lockfiles into a codebase. This Skill audits dependency changes during code review so supply chain risks are caught before merge. ## Core Features & Use Cases - Vulnerability Auditing: Runs pnpm audit, npm audit, pip-audit, or safety check on changed dependency files and reports critical and high CVEs. - Lockfile Analysis: Inspects pnpm-lock.yaml, package-lock.json, poetry.lock, and requirements.txt for suspicious downgrades, removed integrity hashes, and new postinstall scripts. - Package Health Evaluation: Flags typosquat-risk packages with low download counts, unmaintained dependencies, and packages pinned far behind latest versions. - Use Case: A pull request adds three new npm packages and modifies the lockfile. The Skill audits each package for known CVEs, verifies the lockfile changes are intentional, and reports findings with P0-P3 severity classifications to the security reviewer. ## Quick Start Ask the agent to audit the dependency and lockfile changes in this pull request for vulnerabilities and supply chain risks.

Frequently Asked Questions about Security Deps Specialist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit dependencies for vulnerabilities in a pull request?▼

Run pnpm audit or npm audit for JavaScript/TypeScript projects and pip-audit or safety check for Python projects against the changed dependency files. Report critical and high severity CVEs, then manually review lockfile diffs for suspicious changes.

What lockfile changes indicate supply chain attacks?▼

Suspicious lockfile changes include version downgrades that may reintroduce vulnerabilities, new postinstall scripts that execute arbitrary code during install, and removed integrity hashes that may indicate tampering. New direct dependencies should also be verified against PR intent.

How do I detect typosquatting packages in npm dependencies?▼

Flag packages with fewer than 100 weekly downloads as typosquat risks, and check maintenance status including last commit date, open issues, and bus factor. Also flag packages pinned three or more major versions behind the latest release.

What if npm audit or pip-audit is not available?▼

If the audit tool is unavailable, note its absence and proceed with manual lockfile analysis. You can still inspect dependency diffs for downgrades, postinstall scripts, integrity hash removal, and evaluate new packages for maintenance and popularity signals.

How are dependency security findings classified by severity?▼

Findings use four levels: P0 for actively exploited CVEs, P1 for critical CVEs, P2 for high CVEs and outdated packages, and P3 for maintenance concerns. Each finding includes the package, CVE ID, impact, and recommended fix.

Related Skills

Explore More Software Engineering Skills→
dsivovdsivov

dependency-management

Guide safe dependency updates and audits across JavaScript, Python, and Rust ecosystems.

Community
Advanced
commercetoolscommercetools
154

renovate-review

Assess GitHub Renovate PRs for NPM dependency upgrade safety and risk.

Official
Intermediate
AsiaOstrichAsiaOstrich
70

discover

Assess project health, architecture, and risks in existing codebases.

Community
Intermediate
DCx7C5DCx7C5

sca-SKILL.md

Automate Snyk-based scans of package manifests and lockfiles in CI/CD pipelines.

Community
Advanced