菜单
This skill should be used when reviewing dependency changes, lock files, or package additions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Canonical algorithm for consuming DECISIONS_CONTEXT index — scan index, identify relevant entries, Read full bodies on demand, cite verbatim IDs inline.
This skill should be used when evaluating implementation quality before submission, checking correctness, security, and simplicity.
This skill should be used when performing a code review to apply the standard 6-step review process.
This skill should be used when the user asks to "add accessibility", "check ARIA", "handle keyboard navigation", "add focus management", or creates UI components, forms, or interactive elements. Provides WCAG 2.2 AA patterns for keyboard navigation, ARIA roles and states, focus management, color contrast, and screen reader support.
Consumption algorithm for FEATURE_KNOWLEDGE variable — pre-computed feature context
This skill should be used when reviewing code for SOLID violations, tight coupling, or layering issues.
基于 SOC 职业分类
| name | dependencies |
| description | This skill should be used when reviewing dependency changes, lock files, or package additions. |
| user-invocable | false |
| allowed-tools | Read, Grep, Glob |
Domain expertise for dependency management and security analysis. Use alongside devflow:review-methodology for complete dependency reviews.
EVERY DEPENDENCY IS AN ATTACK SURFACE
Each package you add is code you didn't write but must trust. Minimize dependencies. Pin versions. Audit regularly. A single compromised transitive dependency can compromise your entire application. "It's a popular package" is not a security review.
Known CVEs, vulnerable version ranges, malicious packages.
Violation: Wide version range includes vulnerable versions
{ "lodash": "^4.0.0" } // Includes vulnerable 4.17.0-4.17.20
Correct: Pin to safe version
{ "lodash": "^4.17.21" } // First safe version
Unpinned versions, missing lockfiles, dependency conflicts.
Violation: Unpinned allows any version
{ "express": "*", "lodash": "latest" }
Correct: Pin with lockfile
{ "express": "^4.18.2" } // + committed lockfile
Outdated packages, unused dependencies, unnecessary heavy packages.
Violation: Heavy dependency for simple task
{ "moment": "^2.29.4" } // 300KB for date formatting
Correct: Use native or lighter alternative
new Date().toLocaleDateString(); // Native
Incompatible licenses (GPL in MIT project), missing licenses.
Violation: GPL in proprietary code
# GPL-3.0: some-package # Requires your code to be GPL too!
Correct: Use permissive licenses only
npx license-checker --failOn "GPL-3.0;AGPL-3.0"
Deep transitive dependencies, unmaintained packages, typosquatting.
Violation: Typosquatted package
{ "loadsh": "1.0.0" } // Typosquat of "lodash"
Correct: Verify package authenticity
npm view loadsh # Check downloads, repo, maintainers
For extended examples and detection commands, see:
references/violations.md - Extended violation examples by categoryreferences/patterns.md - Correct dependency management patternsreferences/detection.md - Detection commands and CI integration| Severity | Indicators |
|---|---|
| CRITICAL | Known exploited CVEs (CISA KEV), confirmed malicious packages, typosquats |
| HIGH | High severity CVEs, unmaintained packages, GPL in proprietary code |
| MEDIUM | Medium CVEs, significantly outdated, wide version ranges, missing lockfile |
| LOW | Unused dependencies, lighter alternatives available, minor version behind |
Before approving dependency changes:
| Registry | URL |
|---|---|
| npm Advisory | https://www.npmjs.com/advisories |
| Snyk Vuln DB | https://snyk.io/vuln |
| GitHub Advisory | https://github.com/advisories |
| NVD | https://nvd.nist.gov/ |
| CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |