skills.rest
rocklambros
rocklambrosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auditing-pinned-dependencies

Detect unpinned dependency installs and mutable build inputs in repositories.

2|Updated May 23, 2026
Search Tags:#github actions#dockerfile#supply chain#reproducible builds#dependency pinning#ci auditing
One-click install
npx skills add https://github.com/rocklambros/rcs --skill auditing-pinned-dependencies
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auditing-pinned-dependencies
Source: https://github.com/rocklambros/rcs/tree/main/skills/security/auditing-pinned-dependencies
Command: npx skills add https://github.com/rocklambros/rcs --skill auditing-pinned-dependencies

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you catch dependency installs and build inputs that are not pinned to an exact version, reducing supply chain risk and preventing silent drift across builds and deployments.

Core Features & Use Cases

It reviews install commands, Docker base images, CI workflows, package manifests, and Python requirement files to spot mutable versions, risky remote execution patterns, and lockfile gaps. It is useful when auditing a new repository, hardening an existing project, reviewing an MCP install command, or checking a pipeline for reproducibility problems. It returns concrete findings with line references, suggested pinned replacements, and severity guidance so you can fix blocking issues first.

Quick Start

Use this skill to audit the repository for unpinned dependency installs and return each finding with its file, line number, current command, suggested pinned replacement, and severity.

Frequently Asked Questions about auditing-pinned-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a repository for unpinned dependency installs and mutable Docker base images?▼

Auditing unpinned dependencies involves scanning Dockerfiles, CI workflows, and package manifests to detect mutable versions, returning findings with exact line numbers and suggested pinned replacements to prevent silent drift.

What is dependency pinning and why is it needed for reproducible builds?▼

Dependency pinning locks installs to exact versions, preventing silent drift across builds and deployments. It is needed to reduce supply chain risk from mutable build inputs and ensure reproducible builds over time.

Can I check GitHub Actions workflows and MCP configs for risky remote execution patterns?▼

Yes, checking GitHub Actions workflows and MCP configs for risky remote execution patterns is supported. The audit reviews CI workflows and install commands to spot mutable versions and lockfile gaps within these configurations.

How do I fix unpinned requirements file entries and README install instructions?▼

Fix unpinned requirements file entries and README install instructions by replacing mutable version specifiers with exact pinned versions. The audit provides severity guidance and concrete pinned replacements for each finding.

What is the best way to distinguish blocking supply chain issues from warnings during CI auditing?▼

The best way to distinguish blocking supply chain issues from warnings during CI auditing is to apply severity-based guidance. This categorizes unpinned dependencies so you can fix blocking issues first before addressing lower severity warnings.

Does the dependency pinning audit work with Python requirements files and package manifests?▼

Yes, the dependency pinning audit works with Python requirements files and package manifests. It reviews these files alongside Dockerfiles and CI workflows to spot mutable versions, lockfile gaps, and unpinned install commands.

Related Skills

Explore More Software Engineering Skills→
agentuityagentuity
1

agentuity-cli-cloud-env-list

List all cloud environment variables for a project with optional masking.

Official
Basic
pagopapagopa
1

TechAIDocker

Create and modify Dockerfiles with digest-pinned images and secure runtime defaults.

Official
Intermediate
curiositechcuriositech
181

dependency-management

Manage third-party dependencies with version pinning, security auditing, and license compliance.

Official
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced