skills.rest
oliver-kriska
oliver-kriskaCOMMUNITY
Explore all skills by this author →
Website𝕏@quatermain32GitHub

phx-deps-vet

Records vetted Hex package versions in a project-root audit ledger after security review.

537|38|Updated Feb 12, 2026
Search Tags:#hex#dependency audit#Elixir#supply chain security#Phoenix#vetting#mix.lock
One-click install
npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill phx-deps-vet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: phx-deps-vet
Source: https://github.com/oliver-kriska/claude-elixir-phoenix/tree/main/targets/codex/skills/phx-deps-vet
Command: npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill phx-deps-vet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Elixir teams lack a durable, reviewable record of which Hex dependency versions have passed security review, so supply-chain audit findings keep resurfacing and trust decisions get lost.

Core Features & Use Cases

  • Audit ledger management: Appends human-confirmed vetting verdicts (:safe_to_deploy, :safe_to_run, :does_not_implement_crypto) to hex_vet.exs at the project root, visible in PR review alongside mix.lock.
  • Seed import and drift checks: Imports a curated baseline of ~30 vetted packages via --seed, lists existing entries with --list, and cross-checks the ledger against mix.lock with --check.
  • Integration with deps-audit: Runs Phase 1 supply-chain rules before prompting for a verdict, and vetted versions are downgraded to INFO on subsequent phx-deps-audit runs.
  • Use Case: After running a dependency audit on a Phoenix project, vet phoenix 1.7.21 by reviewing its findings, confirming a verdict, and recording it in the ledger so future audits treat it as trusted.

Quick Start

Ask the assistant to vet a specific Hex package version, for example by running phx-deps-vet on phoenix 1.7.21 and confirming the verdict when prompted.

Frequently Asked Questions about phx-deps-vet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I vet a Hex package version after a dependency audit?▼

Run phx-deps-vet with the package name and version, such as phoenix 1.7.21. It fetches the tarball, runs Phase 1 supply-chain rules, shows the findings, and prompts you for a verdict before appending the entry to hex_vet.exs.

What is hex_vet.exs and where does it live?▼

hex_vet.exs is an Elixir audit ledger modeled on cargo-vet's audits.toml, storing package, version, criteria, reviewer, notes, and review date. It lives at the project root next to mix.exs and mix.lock so it appears in PR review and survives .claude/ deletion.

Does the seed import certify my current mix.lock dependencies?▼

No. The seed is a provenance baseline with pinned versions, not certification of your locked dependencies. Per the lock-wins rule, any locked version newer than a seed entry stays unvetted and still requires project-specific review.

What happens when mix.lock and the ledger disagree on a version?▼

The lock wins. If mix.lock has a version the ledger does not cover, that version is treated as unvetted, an INFO finding notes the older ledger entry, and the full Phase 1 rule pass runs on the locked version.

Can entries be auto-approved without user confirmation?▼

No. Every ledger entry must come from an explicit AskUserQuestion confirmation, and confirmation counts are computed from the loaded data before prompting. BLOCK-severity findings default the prompt to Skip and require explicit override.

Related Skills

Explore More Software Engineering Skills→
MFS-codeMFS-code
8

cso

Audit repository security posture with findings, severity ratings, and remediation plans.

Community
Advanced
NVIDIANVIDIA
8.5k

gator-gate

Validate and monitor OpenShell GitHub issues and PRs through a gator label state machine.

Official
Advanced
sgcarstrendssgcarstrends
21

biome-config

Configure Biome linting, formatting, and import-organization across a monorepo.

Official
Advanced
yv1ingyv1ing
701

uv-python

Manages Python dependencies and virtual environments using uv with the system interpreter.

Community
Basic