The Agent Skills Directory

[SAFE]: The skill is designed with a strong security posture, explicitly prohibiting the execution of untrusted installation scripts or major version upgrades without review. It focuses on safe auditing practices by reading manifest and lockfiles rather than running installers.
[SAFE]: The skill utilizes standard, well-known audit tooling (such as npm audit, pip-audit, and cargo audit) to query advisory databases. These tools are used for their intended purpose of identifying known vulnerabilities in dependencies.
[SAFE]: The instructions include specific checks for malicious patterns like typosquatting, AI-generated package confusion, and suspicious pre/post-install scripts, which demonstrates a high degree of security awareness relevant to its primary function.

dependency-security