scan-dependencies
CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use. It MUST be called BEFORE any new package is imported or added to dependencies. It can also be used to check whether any new or existing dependencies are unsafe.
소스 정보
- 저장소
- google/deps.dev
- 최근 소스 활동
- 2026년 6월 9일 22:08
- 감지된 SKILL.md 언어
- 영어
- 스타
- 462
- 포크
- 60
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- scan-dependencies
- description
- CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use. It MUST be called BEFORE any new package is imported or added to dependencies. It can also be used to check whether any new or existing dependencies are unsafe.
# Skill: Evaluate Dependency Security via deps.dev Findings API
## Description
This skill automates the process of auditing package dependencies before
adoption. By querying the Open Source Insights (deps.dev) API, it checks a
batch of package versions for active security findings (advisories and
vulnerabilities) and outputs a clear action plan (ALLOW, CAUTION, or BLOCK).
## Inputs
An array of target dependencies. Each dependency must contain:
* `system`: The ecosystem name. Must be uppercase: `NPM`, `PYPI`, `MAVEN`,
`GO`, `CARGO`, `NUGET`, or `RUBYGEMS`.
* `name`: The canonical name of the package (e.g.,
`org.apache.logging.log4j:log4j-core` for Maven, or normalized lowercase
for PyPI/NuGet).
* `version`: The explicit version string to audit. This may be unset.
Only set the version field if you know the exact version of the package.
This field should **not** be set if only a version range is known (for example,
`^1.0.0` is not acceptable).
---
## Execution Protocol
### Step 1: Construct the JSON Payload
Map the incoming dependency list into a single JSON batch request object.
Ensure all items are nested inside the `"requests"` array under a
`"versionKey"` or `"packageKey"` parameter.
**Payload Schema Example:**
```json
{
"requests": [
{
"versionKey": {
"system": "NPM",
"name": "express",
"version": "4.17.1"
}
},
{
"packageKey": {
"system": "PYPI",
"name": "requests"
}
}
]
}
```
### Step 2: Execute the Live Lookup
Execute the HTTP POST query using curl.
```bash
echo "Scanning dependencies for safety..."
curl -s -X POST https://api.deps.dev/v3alpha/findingsbatch \
-H 'Content-Type: application/json' \
-d '{ "requests": [
{
"versionKey": {
"system": "NPM",
"name": "express",
"version": "4.17.1"
},
{
"packageKey": {
"system": "PYPI",
"name": "requests"
},
...
]'
```
Note that just because a dependency doesn't show up in this list, that doesn't
mean we are 100% sure that it is safe. CRITICAL: Treat unflagged dependencies
as having unknown risk levels. You must state clearly that the scanner only
detects known issues and cannot guarantee absolute security.
GitHub에서 보기