Stats
Actions
Tags
'%20stop-opacity%3D'0.16'%2F%3E%3Cstop%20offset%3D'1'%20stop-color%3D'rgb(200%2C90%2C60)'%20stop-opacity%3D'0.03'%2F%3E%3C%2FlinearGradient%3E%3C%2Fdefs%3E%3Crect%20width%3D'320'%20height%3D'200'%20fill%3D'url(%23g)'%2F%3E%3Ccircle%20cx%3D'250'%20cy%3D'56'%20r%3D'92'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.06'%2F%3E%3Ccircle%20cx%3D'64'%20cy%3D'172'%20r%3D'58'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.05'%2F%3E%3C%2Fsvg%3E)
From skull
Review dependency & supply-chain security — known-vulnerable or outdated packages, typosquatted/ hallucinated names, unpinned or integrity-unverified deps, risky install scripts, and SBOM gaps. Use when a dependency is added or updated, or when auditing a lockfile / package manifest. Complements the supplyguard guardrail.
How this skill is triggered — by the user, by Claude, or both
Slash command
/skull:sec-depsThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Most of a project is someone else's code. (OWASP A06 — vulnerable & outdated components.)
Most of a project is someone else's code. (OWASP A06 — vulnerable & outdated components.)
npm audit, pip-audit,
govulncheck, cargo audit, bundler-audit) and read the results; for a flagged package, confirm the
vulnerable path is reachable. WebFetch the advisory (GHSA/CVE) when you need detail.postinstall / build scripts in dependencies that run arbitrary code — note risky ones.path:line (manifest/lockfile) · CVE/GHSA + CWE · severity (from the advisory + reachability) · evidence ·
fix (upgrade to the patched version / replace / pin / remove). Coverage note.
npx claudepluginhub aturzone/skullAudits project dependencies (npm, pip, Go, Maven, Gradle) for CVEs, supply chain risks, typosquatting, and dependency confusion attacks.
Supply chain security audit using CLI vulnerability scanners, license compliance checks, and supply chain risk assessment. Use when auditing project dependencies for known CVEs, license concerns, and supply chain health.
Audits project dependencies from package.json, requirements.txt, go.mod, Gemfile for CVEs, outdated packages, transitive issues, licenses, and supply chain risks. Provides severity assessments, remediation suggestions, and prioritized reports.