skills.rest
V4-Company
V4-CompanyOFFICIAL
Explore all skills by this author →
WebsiteGitHub

marsai:dev-dep-security-check

Audit dependency installations for identity, vulnerabilities, and lockfile integrity.

2|Updated Apr 10, 2026
Search Tags:#security#npm#pip#audit#supply-chain#dependency#lockfile
One-click install
npx skills add https://github.com/V4-Company/marsai --skill marsai-dev-dep-security-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: marsai:dev-dep-security-check
Source: https://github.com/V4-Company/marsai/tree/main/dev-team/skills/dev-dep-security-check
Command: npx skills add https://github.com/V4-Company/marsai --skill marsai-dev-dep-security-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Intercepts and audits dependency installations before they execute, ensuring only trusted packages enter your codebase by validating identities, scanning for known vulnerabilities, and enforcing lockfile integrity.

Core Features & Use Cases

  • Package identity verification: typosquatting checks, maintainer history, and source validation.
  • Vulnerability and risk assessments: integrates OSV.dev, GitHub Advisory Database, and risk scoring to guide decisions.
  • Lockfile integrity enforcement: validates lockfile hashes and ensures all dependencies are properly pinned.
  • PR and CI workflow protection: blocks unsafe dependency updates during reviews and automated checks.

Quick Start

Install the gate in your CI/CD pipeline and configure it to audit new or updated dependencies.

Frequently Asked Questions about marsai:dev-dep-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and pip dependencies for supply chain attacks?▼

You can prevent typosquatting in package installs by verifying package identity, validating source repositories, and checking maintainer history before the dependency enters your codebase during the installation phase.

How does lockfile integrity enforcement work during dependency updates?▼

Lockfile integrity enforcement works by validating lockfile hashes and ensuring all dependencies are properly pinned, which blocks unsafe dependency updates from executing if their hashes do not match the expected values.

Can I block unsafe dependency updates in CI and PR review workflows?▼

Yes, you can block unsafe dependency updates in CI and PR review workflows by installing an audit gate that intercepts new packages, performs behavioral analysis, and applies risk scoring to make actionable decisions.

What is the best way to check package vulnerabilities before executing an install?▼

The best way to check package vulnerabilities before executing an install is to integrate automated checks against the GitHub Advisory Database and OSV.dev, generating a risk score to guide whether to block the installation.

Does dependency auditing work across both npm and pip ecosystems?▼

Dependency auditing works across both npm and pip ecosystems, applying identity verification, vulnerability checks, and behavioral analysis during install, audit, and PR review workflows to protect your projects.

Related Skills

Explore More Software Engineering Skills→
jd-opensourcejd-opensource
299

pentest-supply-chain

Audit dependencies, CI/CD pipelines, and build artifacts for supply chain risks.

Official
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

risk-prioritization-framework-for-engineers

Prioritize vulnerability remediation using CVSS scores and decision trees.

Official
Advanced
beyonaibeyonai
45

github-code-analysis

Analyze GitHub pull requests for security, performance, and quality issues.

Community
Advanced
leonardodalinkyleonardodalinky
87

uv-package-manager

Install Python packages and manage virtual environments with uv.

Community
Basic