plan-dependency-provenance
Installation
SKILL.md
Dependency Provenance & Supply-Chain Audit + Remediation Plan
Degree of freedom: HIGH — resolve, classify, plan. Stay plan-only. Never install a suspect package to "check".
This skill vs neighbors
| Skill | Owns |
|---|---|
| plan-dependency-provenance (this) | Slopsquatting / SBOM / license plan |
plan-security-audit |
OWASP umbrella burndown |
workflow-housekeep |
Apply dependency updates after approval |
How to reason (every plan item)
- Propose — verify, remove, pin, or license-remediate a package
- Risk — squat, unsigned install, license conflict, or lockfile roll
- Keep-working — packages that already resolve, pin, and license clean
- Phase — verify/remove → lock & pin → license → de-bloat (do not execute)