Read-only audit of a project's third-party dependencies — lockfile discipline, hallucinated and typosquatted package names (slopsquatting), dependency confusion, install-script exposure, maintenance and provenance, license conflicts, and CVE reachability — producing evidence-backed findings and a SHIP / FIX / BLOCK verdict. Use when the user asks to 'audit dependencies', 'check the supply chain', 'is this package safe', 'проверь зависимости', to review a package.json/requirements/go.mod change, before adding a dependency, or after a bot PR bumps versions. Do not use for vulnerabilities in the project's own source code (use awesome-security-audit), for CI workflow hardening (its CI/CD category covers that), or to execute the upgrades the audit calls for — use awesome-dependency-upgrade; this skill audits the dependency graph itself.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Read-only audit of a project's third-party dependencies — lockfile discipline, hallucinated and typosquatted package names (slopsquatting), dependency confusion, install-script exposure, maintenance and provenance, license conflicts, and CVE reachability — producing evidence-backed findings and a SHIP / FIX / BLOCK verdict. Use when the user asks to 'audit dependencies', 'check the supply chain', 'is this package safe', 'проверь зависимости', to review a package.json/requirements/go.mod change, before adding a dependency, or after a bot PR bumps versions. Do not use for vulnerabilities in the project's own source code (use awesome-security-audit), for CI workflow hardening (its CI/CD category covers that), or to execute the upgrades the audit calls for — use awesome-dependency-upgrade; this skill audits the dependency graph itself.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Read-only audit of a project's third-party dependencies — lockfile discipline, hallucinated and typosquatted package names (slopsquatting), dependency confusion, install-script exposure, maintenance and provenance, license conflicts, and CVE reachability — producing evidence-backed findings and a SHIP / FIX / BLOCK verdict. Use when the user asks to 'audit dependencies', 'check the supply chain', 'is this package safe', 'проверь зависимости', to review a package.json/requirements/go.mod change, before adding a dependency, or after a bot PR bumps versions. Do not use for vulnerabilities in the project's own source code (use awesome-security-audit), for CI workflow hardening (its CI/CD category covers that), or to execute the upgrades the audit calls for — use awesome-dependency-upgrade; this skill audits the dependency graph itself.
About this listing
Category
Security
Reported license
MIT
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI