SKILL05application-security
Auditing Dependency Risk
Assesses installed third-party and software-supply-chain risk from lockfiles, advisories, runtime reachability, provenance, integrity controls, and remediation options.
Primary benefit
Separates actionable dependency risk from noisy advisory counts and avoids unsafe broad upgrades without application context.When to use
Use when a project needs software-supply-chain or third-party dependency risk assessed from manifests, lockfiles, advisories, provenance, maintenance signals, and realistic runtime exposure before upgrades or release.
When not to use
Do not use when the task is purely an application-code vulnerability review with no dependency or build-chain question.
Use cases
Triage npm audit or equivalent findings before a production release
Review whether the project's lockfile, registry, install, and provenance practices reduce supply-chain risk
Example prompts
Use auditing-dependency-risk to triage this project's dependency advisories by actual reachability and supply-chain exposure, then recommend the smallest safe remediation.Install this skill
Choose the command for your operating system and run it from the repository root.
Bash
./install.sh --skill auditing-dependency-riskPowerShell
./install.ps1 --skill auditing-dependency-riskChatGPT
Download Skill ZIPCompatibility
- Surfaces
- ChatGPT · Codex · Claude Code
- Operating systems
- Linux · macOS · Windows
- Install modes
- PluginFilesystem
Dependencies
No external dependencies
Part of systems
Curated systems that canonically include this method.