What problem does it solve? Security teams need to know which project dependencies are at heightened risk of exploitation or maintainer takeover before an engagement, but manually researching every dependency's maintenance status, popularity, and history is slow and error-prone. ## Core Features & Use Cases - Risk Factor Evaluation: Assesses each dependency against six criteria including single-maintainer projects, unmaintained code, low popularity, high-risk features like FFI or deserialization, past CVEs, and missing security contacts. - Accurate GitHub Data: Uses the gh CLI to query exact star counts, open issues, and repository status so every cited number is verifiable. - Structured Report Generation: Produces a results.md report with a high-risk dependencies table, suggested alternatives, risk factor counts, and an executive summary. - Use Case: Before scoping a security audit of a web application, run this Skill to flag that a core parsing library is maintained by one anonymous developer with unpatched CVEs, and get a drop-in replacement recommendation. ## Quick Start Audit this project's dependencies for supply chain risk and generate a report of high-risk packages with suggested alternatives.
