菜单
Use when adding, bumping, or changing a dependency in package.json, requirements.txt, pyproject.toml, Cargo.toml, or a .csproj. Triggered automatically by version-sentinel's PreToolUse hook — this skill explains how to satisfy the hook.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Quantum-Serendipity/qsdev --skill version-sentinel命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Add a dependency or package to the project safely. Use when the user asks to install, add, or include a package, library, tool, language, or service.
Detect project ecosystems, languages, package managers, and frameworks.
Disable a tool from the qsdev project configuration.
基于 SOC 职业分类
正在显示 SKILL.md
| name | version-sentinel |
| description | Use when adding, bumping, or changing a dependency in package.json, requirements.txt, pyproject.toml, Cargo.toml, or a .csproj. Triggered automatically by version-sentinel's PreToolUse hook — this skill explains how to satisfy the hook. |
The version-sentinel plugin blocks dependency changes until you've verified the package version against its upstream registry. Here's the required flow:
If a tool call exits 2 with BLOCKED: version-sentinel, you must:
Look up the latest version. Use WebSearch first:
npm: search "<pkg> latest version site:npmjs.com"pip/pyproject: search "<pkg> latest version site:pypi.org"csproj: search "<pkg> latest version site:nuget.org"cargo: search "<pkg> latest version site:crates.io"If WebSearch is unavailable (non-US region), use WebFetch on the registry URL directly, or consult context7's query-docs tool for the package.
Record the check. Invoke:
/vs-record <ecosystem> <pkg> <version-you-intend-to-install> <source-url>
The source must be an http(s):// URL from your search OR prefixed with intentional: for deliberate pins.
Retry the original edit or install. The hook will see the fresh entry and let the tool call through.
If you genuinely intend to install an older version (CVE mitigation, compat, private registry), record with:
/vs-record <ecosystem> <pkg> <version> "intentional: <brief reason>"
This passes the hook and is flagged as intentional-pin (not DRIFT) in /check-versions output.
git commit --no-verify or similar — the hook runs on Edit/Write/Bash, not on git.unset VS_DISABLE without the user's awareness; that's an escape hatch for throwaway sessions, not normal flow./check-versions scans every manifest under the current directory and reports drift. Run it before tagging a release.