What problem does it solve? AI-generated code frequently contains hallucinated imports, non-existent packages, phantom functions, and incorrect API signatures, and attackers exploit this via slopsquatting — registering package names that AI commonly invents. This Skill validates every reference in generated code before it is committed. ## Core Features & Use Cases - Import Verification: Extracts all import/require/use statements from changed files, confirms internal files exist, and checks that specific exported symbols are actually defined. - Dependency & Registry Checks: Validates external packages against package.json, requirements.txt, pyproject.toml, or Cargo.toml, and verifies new packages exist on npm, PyPI, or crates.io. - Slopsquatting Defense: Flags package names with edit distance ≤ 2 from popular packages (e.g., axois vs axios) and checks popularity signals for suspicious newly registered packages. - Use Case: After an AI coding session adds import axios from 'axois', the guard blocks the commit, reports the package does not exist on npm, and suggests the correct package name. ## Quick Start Verify all imports and API calls in the files just changed and report any hallucinated packages or phantom functions.
