skills.rest
seifreed
seifreedCOMMUNITY
Explore all skills by this author →
𝕏@seifreedGitHub

Dependency Review Skill

Review package manifests and build hooks for security risks before installation.

26|Updated Feb 8, 2026
Search Tags:#security#npm#build#review#policy#dependency
One-click install
npx skills add https://github.com/seifreed/skill-veil --skill dependency-review-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Dependency Review Skill
Source: https://github.com/seifreed/skill-veil/tree/main/examples/manifest-package
Command: npx skills add https://github.com/seifreed/skill-veil --skill dependency-review-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the security risks associated with software dependencies by reviewing package manifests and build hooks before installation.

Core Features & Use Cases

  • Dependency Auditing: Analyzes package.json and similar manifest files for potential vulnerabilities.
  • Build Hook Scrutiny: Flags potentially malicious or risky scripts executed during the build or installation process (e.g., postinstall scripts).
  • Policy Enforcement: Enforces rules such as preferring pinned dependencies and blocking remote binary fetches.
  • Use Case: Before deploying a new service, use this Skill to automatically scan its dependencies and ensure no unauthorized code is introduced via installation scripts.

Quick Start

Run the Dependency Review Skill on the current project's package.json file.

Frequently Asked Questions about Dependency Review Skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan package.json for security vulnerabilities before installation?▼

Reviewing package.json involves analyzing manifest files and build hooks to identify security risks before software installation. The dependency review process flags risky install scripts and enforces policies against remote binary fetches.

What is a postinstall script and why does it pose a security risk?▼

A postinstall script is a build hook executed automatically during the dependency installation process. It poses a security risk because it can run unauthorized or malicious code, requiring scrutiny to block unauthorized remote binary fetches.

How do I enforce pinned dependencies and block remote binary fetches in Node.js?▼

Enforcing pinned dependencies involves applying policy rules during manifest review to restrict dynamic versions. The review process checks package files to block remote binary fetches and flags install hooks for human approval.

Does this dependency review tool work with build hooks in my current software engineering workflow?▼

The dependency review tool works within software engineering workflows by analyzing package manifests and local build hooks. It is particularly suited for Node.js projects to flag risky installation scripts for human review.

When should I review dependencies for malicious install scripts?▼

You should review dependencies for malicious install scripts before deploying a new service or installing new packages. This scrutiny prevents unauthorized code execution by identifying risky build hooks and blocking remote binary fetches.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

pentest-agent-ci

Validate pentest agent configurations and scope files in CI/CD pipelines.

Community
Advanced
seifreedseifreed
26

remote-exec-doc

Document security policies against remote execution patterns like curl pipe bash.

Community
Basic
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced
hamzaPixlhamzaPixl
2

security-scan

Scan code repositories and container images for secrets, OWASP Top 10 vulnerabilities, dependency CVEs, and RBAC misconfigurations.

Community
Intermediate