live-dependency-resolver
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements anti-hallucination measures by requiring agents to verify package versions using live metadata lookups instead of training data.
- [SAFE]: Remote lookups target official and well-known registries (e.g., registry.npmjs.org, pypi.org, crates.io, rubygems.org), which are established and trusted services.
- [SAFE]: The skill performs local environment discovery by checking for existing installations in common AI skill directories (e.g., ~/.claude/skills/) to recommend relevant companion tools from the same vendor.
- [SAFE]: While user-provided package names are interpolated into shell commands (e.g.,
npm view <pkg>), the commands are restricted to metadata retrieval from trusted sources, minimizing the impact of potential indirect prompt injection.
Audit Metadata