deps-vet

Records vetted Hex package versions in a hex_vet.exs audit ledger after security review.

537|38|Updated Feb 12, 2026

Search Tags:#hex #dependency audit #Elixir #vetting #supply-chain security #Ledger #mix.lock

Ready to run

npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill deps-vet

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deps-vet
Source: https://github.com/oliver-kriska/claude-elixir-phoenix/tree/main/plugins/elixir-phoenix/skills/deps-vet
Command: npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill deps-vet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Elixir teams lack a durable, reviewable record of which Hex dependency versions have passed a supply-chain security review, so audit findings keep resurfacing and trust decisions get lost.

Core Features & Use Cases

Audit ledger management: Appends human-confirmed vetting verdicts (:safe_to_deploy, :safe_to_run, :does_not_implement_crypto) to a project-root hex_vet.exs file that is visible in PR review.
Seed import: Imports a curated baseline of ~30 pre-vetted high-download Hex packages with computed new/overwrite/no-op counts before confirmation.
Drift detection: Cross-checks mix.lock against the ledger with --check and lists existing entries with --list.
Use Case: After running /phx:deps-audit and reviewing findings for phoenix 1.7.21, run the vet flow to record the verdict so future audits downgrade that finding to INFO.

Quick Start

Ask the assistant to vet the package phoenix version 1.7.21 and record the result in hex_vet.exs.

Frequently Asked Questions about deps-vet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I vet a Hex package version after a deps audit?▼

Run the deps-vet flow with the package name and version, for example `deps-vet phoenix 1.7.21`. It fetches the tarball, runs Phase 1 supply-chain rules, shows findings, and prompts for a verdict before appending to hex_vet.exs.

What is hex_vet.exs and where does it live?▼

hex_vet.exs is an Elixir-term audit ledger modeled on cargo-vet's audits.toml, storing package, version, criteria, reviewer, notes, and review date. It lives at the project root so it appears in PR diffs alongside mix.lock.

Can I bootstrap the ledger with pre-vetted packages?▼

Yes, the --seed flag imports a curated baseline of roughly 30 high-download Hex packages. It computes criteria splits and new/overwrite/no-op counts before prompting, and never silently overwrites existing entries.

What happens when mix.lock and the ledger disagree on a version?▼

The lock wins: the locked version is treated as unvetted and the older ledger entry is downgraded to an informational note. This prevents version-bump attacks where trust was granted to a different release.

Does deps-vet auto-approve packages without review?▼

No, every ledger entry requires an explicit AskUserQuestion confirmation with findings shown first. BLOCK-severity findings default the prompt to Skip and require explicit override before granting safe_to_deploy.