Agent skill
dependency-security
Managing Supply Chain Security, SBOM generation, and vulnerability patching (SCA).
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/security-andreibesleaga-gabbe-12
SKILL.md
dependency-security Skill
This skill secures the software supply chain.
1. Software Composition Analysis (SCA)
"You are what you import."
- Audit: Run
npm audit/pip-audit/cargo auditin CI. - Block: Fail the build on
CRITICALorHIGHvulnerabilities. - Lock: Always verify lockfiles (
package-lock.json) matchpackage.json.
2. SBOM (Software Bill of Materials)
- Generate a list of all ingredients in your software.
- Tools:
syft,cyclonedx-cli. - Why? Rapid response when the next Log4Shell happens.
3. Dependency Pinning
- Pin Exact Versions: Avoid
^1.2.3in critical apps. Use1.2.3to prevent "works on my machine" drift. - Private Registry: For enterprise, proxy public registries to prevent "Left-Pad" incidents.
4. Typosquatting Defense
- Scope: Use
@myorg/packagescopes. - Verify: Check download counts and maintainer reputation before adding new deps.
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?