endor-dependency-provenance

What problem does it solve?

This Skill helps you determine exactly where a package version came from when the same dependency appears through multiple manifests, refs, or commit shas. It prevents incorrect rollups that hide whether a package was introduced directly or transitively.

Core Features & Use Cases

• Exact provenance grouping: Separates dependency paths by package coordinate, manifest file path, and source ref or sha.
• Direct vs transitive analysis: Distinguishes whether a package was introduced explicitly or inherited through another dependency.
• Evidence-backed reporting: Produces a path-by-path matrix with parent package details and resource identifiers when available.
• Use case: A project shows the same package at different versions across requirements, lockfiles, and branches, and you need to explain each introduction path without merging them.

Quick Start

Use the dependency provenance skill to identify every distinct introduction path for the specified package across the given project, manifest files, and source ref or commit sha.