菜单
Dependency health audit. Scans for vulnerabilities, outdated packages, license issues, and supply chain risk. Produces SBOM. On-demand or pre-deployment gate.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Standalone adversarial analysis module. Generates the strongest honest case against an artifact or decision. Invokable directly by any caller — not only Reviewer. Challenger mode controls whether challenge is open (no spec) or spec-bound (against a declared spec artifact). Do NOT invoke to issue a verdict or score — that is Grader's job. Do NOT invoke when the goal is to produce or implement a fix — that is Executor's job.
Root cause investigation using structured analysis methods. 5-whys, fishbone, fault-tree. Knowledge-graph-leveraged when Nexus is available. On-demand.
API lifecycle management. Version, deprecate, audit contracts, enforce backward compatibility. Four modes: --version, --deprecate, --contract, --audit.
Gateway routing engine. Reads the active platform package and capability gateways to determine which modules are relevant to the current wave. Assembles multi-module context using Economy placement rules. Produces delta proposals (ADDITIVE/COSMETIC → Specify --patch, BREAKING → Executor halt). Writes only to product space — never touches .wabblespec/ (I11).
Finalizes a completed execution by aggregating all receipts into one delivery receipt, bumping the version, and appending a changelog entry. A task is not done until Archive runs.
Writes experimental implementation of a module change from an approved Blueprint. For AUGMENT type: completes a modified copy of the existing module. For NEW type: completes Factory stubs. All output goes to .wabblespec/state/experiments/augments/. Never touches production module space.
| name | deps |
| description | Dependency health audit. Scans for vulnerabilities, outdated packages, license issues, and supply chain risk. Produces SBOM. On-demand or pre-deployment gate. |
Dependencies are trusted code you did not write. Their security posture is your security posture. You scan every dependency, classify risk, flag violations, and produce a software bill of materials.
Scans all project dependencies. Classifies risk per dimension (vulnerability, age, license, supply chain). Produces SBOM. Writes deps receipt.
/deps commandParse all package manifests and lock files. Count total dependencies (direct + transitive). Record deps_scanned.
See rules/health-dimensions.md. For each dependency, check:
Per rules/risk-tiers.md:
CRITICAL: Known vulnerability with CVSS ≥ 9.0, or license incompatibility that blocks distributionHIGH: CVSS 7.0–8.9, or abandoned package (no releases in 2+ years)MEDIUM: CVSS 4.0–6.9, or significantly outdated (major version behind)LOW: Minor version behind, low-severity advisoryUNKNOWN: Unable to determine risk (private registry, no metadata)Write SBOM to .wabblespec/deps/sbom-<timestamp>.json. Format per rules/sbom-format.md (SPDX-compatible subset).
| Situation | Reference |
|---|---|
| Deps receipt write | engine/shared/references/script-delegation-contract.md → receipt-writer.py --type generic for the base, then --extra-json for the module-specific fields defined in schemas/deps-receipt.schema.json |
deps-receipt.json (.wabblespec/state/receipts/deps-receipt-<timestamp>.json):
{
"deps_scanned": "integer",
"risk_summary": {
"critical": "integer",
"high": "integer",
"medium": "integer",
"low": "integer",
"unknown": "integer"
},
"outdated_count": "integer",
"license_violations": "integer",
"sbom_path": ".wabblespec/deps/sbom-<timestamp>.json",
"supply_chain_flags": ["array of {package, reason} objects"]
}
Receipt status = FAIL if risk_summary.critical > 0. PARTIAL if risk_summary.high > 0. PASS otherwise.