Menu
Dependency health audit. Scans for vulnerabilities, outdated packages, license issues, and supply chain risk. Produces SBOM. On-demand or pre-deployment gate.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Standalone adversarial analysis module. Generates the strongest honest case against an artifact or decision. Invokable directly by any caller — not only Reviewer. Challenger mode controls whether challenge is open (no spec) or spec-bound (against a declared spec artifact). Do NOT invoke to issue a verdict or score — that is Grader's job. Do NOT invoke when the goal is to produce or implement a fix — that is Executor's job.
Root cause investigation using structured analysis methods. 5-whys, fishbone, fault-tree. Knowledge-graph-leveraged when Nexus is available. On-demand.
API lifecycle management. Version, deprecate, audit contracts, enforce backward compatibility. Four modes: --version, --deprecate, --contract, --audit.
Gateway routing engine. Reads the active platform package and capability gateways to determine which modules are relevant to the current wave. Assembles multi-module context using Economy placement rules. Produces delta proposals (ADDITIVE/COSMETIC → Specify --patch, BREAKING → Executor halt). Writes only to product space — never touches .wabblespec/ (I11).
Finalizes a completed execution by aggregating all receipts into one delivery receipt, bumping the version, and appending a changelog entry. A task is not done until Archive runs.
Writes experimental implementation of a module change from an approved Blueprint. For AUGMENT type: completes a modified copy of the existing module. For NEW type: completes Factory stubs. All output goes to .wabblespec/state/experiments/augments/. Never touches production module space.
| name | deps |
| description | Dependency health audit. Scans for vulnerabilities, outdated packages, license issues, and supply chain risk. Produces SBOM. On-demand or pre-deployment gate. |
Dependencies are trusted code you did not write. Their security posture is your security posture. You scan every dependency, classify risk, flag violations, and produce a software bill of materials.
Scans all project dependencies. Classifies risk per dimension (vulnerability, age, license, supply chain). Produces SBOM. Writes deps receipt.
/deps commandParse all package manifests and lock files. Count total dependencies (direct + transitive). Record deps_scanned.
See rules/health-dimensions.md. For each dependency, check:
Per rules/risk-tiers.md:
CRITICAL: Known vulnerability with CVSS ≥ 9.0, or license incompatibility that blocks distributionHIGH: CVSS 7.0–8.9, or abandoned package (no releases in 2+ years)MEDIUM: CVSS 4.0–6.9, or significantly outdated (major version behind)LOW: Minor version behind, low-severity advisoryUNKNOWN: Unable to determine risk (private registry, no metadata)Write SBOM to .wabblespec/deps/sbom-<timestamp>.json. Format per rules/sbom-format.md (SPDX-compatible subset).
| Situation | Reference |
|---|---|
| Deps receipt write | engine/shared/references/script-delegation-contract.md → receipt-writer.py --type generic for the base, then --extra-json for the module-specific fields defined in schemas/deps-receipt.schema.json |
deps-receipt.json (.wabblespec/state/receipts/deps-receipt-<timestamp>.json):
{
"deps_scanned": "integer",
"risk_summary": {
"critical": "integer",
"high": "integer",
"medium": "integer",
"low": "integer",
"unknown": "integer"
},
"outdated_count": "integer",
"license_violations": "integer",
"sbom_path": ".wabblespec/deps/sbom-<timestamp>.json",
"supply_chain_flags": ["array of {package, reason} objects"]
}
Receipt status = FAIL if risk_summary.critical > 0. PARTIAL if risk_summary.high > 0. PASS otherwise.