Lockfile Security Auditor

The XZ Utils backdoor wasn't in a CVE database. It was introduced through a dependency that looked legitimate until it wasn't.

Your lockfile is a contract with the supply chain. This skill reads it for what it actually says — not just which packages are there, but whether the lockfile matches your manifest, whether integrity hashes are intact, and whether any entries were quietly swapped, added, or tampered with.

Supports npm, yarn, pnpm, poetry, pip, cargo, go modules. Zero external API.

Trigger Phrases

• "lockfile audit", "package-lock security", "lock file check"
• "phantom dependency", "lockfile drift", "supply chain check"
• "integrity hash", "package-lock.json tampering"
• "yarn.lock audit", "Cargo.lock check", "go.sum audit"
• "lockfile out of sync", "stale lockfile"
• "/lock-file-audit"