supply-chain

Secure dependencies by pinning direct versions to exact numbers, committing lockfiles with hashes, running vulnerability scans in CI, and forbidding remote code execution during installs across npm, pip, and cargo ecosystems.

Dependency pinning locks direct dependencies to exact versions instead of open ranges. It is needed to prevent malicious or compromised packages from being introduced through unpinned dependencies during builds or runtime.

Prevent remote code execution in CI configuration by ensuring no install hooks or CI steps pipe remote content directly into a shell, and by verifying all AI-suggested or unrecognized package names before installation.

Vulnerability scanning in CI does fail the build on high-severity findings. Automated scans run in CI to flag vulnerable code, explain the risk, and block builds when high-severity issues are detected in the dependency graph.

A transitive dependency needs a lockfile with hashes to record resolved versions and verify integrity. A single poisoned transitive dependency can give attackers arbitrary code execution if not verified and locked.

You can audit an existing project manifest to find unpinned dependencies. The skill flags vulnerable code, identifies open ranges or missing lockfiles, and suggests fixes to harden the dependency graph.