skills.rest
Z-M-Huang
Z-M-HuangCOMMUNITY
Explore all skills by this author →
Website𝕏@markhuang_aiGitHub

vcp-dependency-check

Validate project dependencies against VCP dependency-management standards.

14|3|Updated Feb 13, 2026
Search Tags:#security#dependencies#analysis#registry#typosquatting#lockfile
One-click install
npx skills add https://github.com/Z-M-Huang/vcp --skill vcp-dependency-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vcp-dependency-check
Source: https://github.com/Z-M-Huang/vcp/tree/main/plugins/vcp/skills/vcp-dependency-check
Command: npx skills add https://github.com/Z-M-Huang/vcp --skill vcp-dependency-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams enforce VCP dependency management standards by auditing dependencies, lockfiles, and version constraints to prevent insecure or malformed packages.

Core Features & Use Cases

  • Lockfile hygiene: Detect missing or untracked lockfiles and advise on proper synchronization.
  • Version-range validation: Flag broad or unsafe version specifiers and suggest pinning where appropriate.
  • Registry verification: Check that dependencies exist in official registries and are within expected popularity ranges.
  • Install script awareness: Warn about dependencies with install scripts that may execute code during install.
  • Use Case: Apply to a JavaScript or Python project to proactively surface supply chain risks before deployment.

Quick Start

Run the vcp-dependency-check skill against your project to generate a structured dependency report.

Frequently Asked Questions about vcp-dependency-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit project dependencies for supply chain risks?▼

You audit project dependencies by analyzing lockfiles and manifests against VCP dependency-management standards, generating a filtered findings report that flags unsafe version specifiers and missing lockfiles.

What is lockfile hygiene and why does it matter for package security?▼

Lockfile hygiene detects missing or untracked lockfiles and advises on proper synchronization, preventing insecure or malformed packages from compromising your project's dependency tree.

Can I check npm and pip dependencies for typosquatting and registry existence?▼

Yes, you can check npm, pip, and go dependencies by verifying their existence in official registries and validating them against expected popularity ranges to surface typosquatting risks.

How do I flag broad or unsafe version ranges in a lockfile?▼

You flag unsafe version specifiers by applying core-dependency-management rules to manifests, which identifies broad version ranges and suggests pinning dependencies to secure versions.

Does this dependency analysis work with projects using install scripts?▼

Yes, the dependency analysis works with projects using install scripts by warning about dependencies that execute code during installation, helping surface behavioral indicators before deployment.

How do I configure dependency validation for my project root?▼

You configure dependency validation by setting up a .vcp/config.json file, which the tool reads to locate manifests and lockfiles in the project root and analyze them against core rules.

Related Skills

Explore More Software Engineering Skills→
agentik-osagentik-os
10

depaudit

Audit dependency supply chains for CVEs, licensing, and provenance risks.

Community
Advanced
kernex-devkernex-dev
1

security-engineer

Audit codebases and configurations to identify vulnerabilities with structured findings.

Official
Advanced
LuisSambranoLuisSambrano
7

code-review

Perform systematic code review and static analysis across multiple programming languages.

Community
Advanced
adityaarsharmaadityaarsharma
2

orbit-sec-supply-chain

Audit Composer and npm dependencies for CVEs, licenses, and typosquatting risks.

Community
Advanced