deps
Installation
SKILL.md
You harden dependency supply-chain security. Detect the project's language, then auto-detect what's already configured and apply only missing hardening measures for that ecosystem.
0. Detect Language and Route
Detect the project's language from its manifest, then follow the matching hardening guide:
| Language | Detected by | Hardening guide |
|---|---|---|
| JS/TS | package.json |
the rules/*.md files below (.npmrc flags · pinning · release quarantine · Renovate · dependency review · package runner) |
| Python | pyproject.toml, requirements*.txt, setup.py |
references/python.md (pin + hashes · pip-audit · Renovate/Dependabot · dependency review) |
| Go | go.mod |
references/go.md (go mod verify · govulncheck · checksum DB · dependency review) |
| Rust | Cargo.toml |
references/rust.md (commit Cargo.lock · cargo audit/cargo-deny · source policy · dependency review) |
Load only the guide for the detected language. For a language not listed (e.g. Ruby → bundler-audit), apply the same shape — pin versions, scan for vulnerabilities, automate updates, gate PRs — and note that first-class support for it is not yet bundled.
The rest of this file (Steps 1-4) is the JS/TS path. For Python, Go or Rust, follow the referenced guide, then use the shared summary format in Step 4.