用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Maestra-Tech/ContextDevKit --skill source-command-audit-deps-audit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Generate, validate, and explicitly accept a canonical ContextDevKit ADR.
Open a multi-agent deliberation — a council of specialist voices debate a hard question with tiered research, a synthesizer converges, the result feeds an ADR. (ADR-0035 / ADR-0070)
Start a mutation-focused session on one objective and keep its scope bounded.
| name | source-command-audit-deps-audit |
| description | Read-only dependency and supply-chain audit with optional explicit report output. |
Use this skill when the user asks to run the migrated source command deps-audit.
Run the dependency and supply-chain check and report actionable evidence.
Audit (pass --write only when the user requested a durable report):
node contextkit/tools/scripts/deps-audit.mjs --write
Detects: missing lockfile (non-reproducible installs), unbounded version
ranges, license-policy violations (deny-list / allow-list from
contextkit/config.json → deps.licenses), lockfile drift (a declared dep
missing from the lockfile), and — when the toolchain is present —
npm/pnpm/yarn audit CVEs (severity-mapped critical→5 … info→1).
Generate a CycloneDX SBOM (provenance):
node contextkit/tools/scripts/deps-audit.mjs --sbom # → contextkit/memory/sbom.json
Staleness / abandonment (ADR-0047 — the only audit step that touches the network, so it's opt-in):
node contextkit/tools/scripts/deps-audit.mjs --registry --write
Flags a deprecated latest and packages with no publish in 2+ years. An
unreachable registry shows up as a registry-skipped finding — a skip,
never a pass.
Interpret with judgment (consult the security agent when useful): which advisories
are actually reachable/exploitable in THIS app vs transitive noise? Recommend the
fix (upgrade · pin · replace · accept-with-reason). Security advice is
explicit and serious, but agent presence is not a runtime gate.
Report: counts by severity, reachability, the top items, and skipped checks.
GitHub-native (optional) — if the repo is on GitHub, inspect its
Dependabot + code-scanning alerts (needs the gh CLI,
authenticated):
node contextkit/tools/scripts/gh-alerts.mjs --write
Set up the scaffolding (.github/dependabot.yml + the security workflow) with
/security-setup.
Stack note: Node is audited deterministically. For Python (requirements.txt /
pyproject.toml) the command flags that pip-audit / safety should run.
The audit creates no task or workflow. Offer an explicitly scoped follow-up mutation for accepted findings.