dependency-audit

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

在引入依赖或 PR 前降低供应链攻击面。

这个 Skill 做什么

审计项目依赖以发现已知漏洞、恶意包与供应链风险。

帮你检查项目依赖里有没有已知漏洞、恶意包或供应链风险，常在新增/升级依赖、审查 package.json、requirements.txt、go.mod 等清单或合并相关 PR 前用。会指出有 CVE、可疑发布或未锁版本的库，并建议用 lockfile 和 CI 扫描把风险挡住。特点是把依赖清单、锁文件和自动化检查结合，尽早在构建线上发现问题。

▸ 展开 SKILL.md 英文原文

Audit project dependencies for known vulnerabilities, malicious packages, and supply chain risks — Applies to: when adding a new dependency; when upgrading dependencies; when reviewing package manifests (package.json, requirements.txt, go.mod, Cargo.toml); before merging a PR that modifies dependency files

开发编程依赖审计供应链漏洞扫描通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/dependency-audit/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/dependency-audit/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/dependency-audit/SKILL.md. -->

# Dependency Audit

Audit project dependencies for known vulnerabilities, malicious packages, and supply chain risks

## ALWAYS

- Pin dependencies to exact versions in lockfiles (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `poetry.lock`, `go.sum`, `Cargo.lock`).
- Cross-check every new dependency name against the bundled malicious-package list in `vulnerabilities/supply-chain/malicious-packages/`.
- Prefer well-established packages with high download counts, multiple maintainers, and re

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有