skills.rest
oliver-kriska
oliver-kriskaCOMMUNITY
Explore all skills by this author →
Website𝕏@quatermain32GitHub

deps-vet

Records vetted Hex package versions in a hex_vet.exs audit ledger after security review.

537|38|Updated Feb 12, 2026
Search Tags:#hex#dependency audit#Elixir#vetting#supply-chain security#Ledger#mix.lock
One-click install
npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill deps-vet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deps-vet
Source: https://github.com/oliver-kriska/claude-elixir-phoenix/tree/main/plugins/elixir-phoenix/skills/deps-vet
Command: npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill deps-vet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Elixir teams lack a durable, reviewable record of which Hex dependency versions have passed a supply-chain security review, so audit findings keep resurfacing and trust decisions get lost.

Core Features & Use Cases

  • Audit ledger management: Appends human-confirmed vetting verdicts (:safe_to_deploy, :safe_to_run, :does_not_implement_crypto) to a project-root hex_vet.exs file that is visible in PR review.
  • Seed import: Imports a curated baseline of ~30 pre-vetted high-download Hex packages with computed new/overwrite/no-op counts before confirmation.
  • Drift detection: Cross-checks mix.lock against the ledger with --check and lists existing entries with --list.
  • Use Case: After running /phx:deps-audit and reviewing findings for phoenix 1.7.21, run the vet flow to record the verdict so future audits downgrade that finding to INFO.

Quick Start

Ask the assistant to vet the package phoenix version 1.7.21 and record the result in hex_vet.exs.

Frequently Asked Questions about deps-vet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I vet a Hex package version after a deps audit?▼

Run the deps-vet flow with the package name and version, for example `deps-vet phoenix 1.7.21`. It fetches the tarball, runs Phase 1 supply-chain rules, shows findings, and prompts for a verdict before appending to hex_vet.exs.

What is hex_vet.exs and where does it live?▼

hex_vet.exs is an Elixir-term audit ledger modeled on cargo-vet's audits.toml, storing package, version, criteria, reviewer, notes, and review date. It lives at the project root so it appears in PR diffs alongside mix.lock.

Can I bootstrap the ledger with pre-vetted packages?▼

Yes, the --seed flag imports a curated baseline of roughly 30 high-download Hex packages. It computes criteria splits and new/overwrite/no-op counts before prompting, and never silently overwrites existing entries.

What happens when mix.lock and the ledger disagree on a version?▼

The lock wins: the locked version is treated as unvetted and the older ledger entry is downgraded to an informational note. This prevents version-bump attacks where trust was granted to a different release.

Does deps-vet auto-approve packages without review?▼

No, every ledger entry requires an explicit AskUserQuestion confirmation with findings shown first. BLOCK-severity findings default the prompt to Skip and require explicit override before granting safe_to_deploy.

Related Skills

Explore More Software Engineering Skills→
ImaginerLabsImaginerLabs

security-review

Scan codebases for security vulnerabilities and generate severity-grouped findings with patch proposals.

Official
Advanced
BedaBeda-GrowthBedaBeda-Growth

verify-agent

Verify agent completions against CI gates and acceptance criteria.

Official
Advanced
BicameralAIBicameralAI

bicameral-reset

Perform two-step dry-run and confirm resets of polluted ledgers.

Official
Intermediate
florianbuetowflorianbuetow
12

outdated-deps

Scan project dependencies for CVEs, unpinned versions, and typosquatting risks.

Community
Advanced