Dependency & supply-chain security

When to use this skill

Use this skill whenever code consumes third-party code or assets:

• Adding a Composer package, or vendoring a library copy into vendor/ or assets/lib/.
• Enqueueing a script or stylesheet whose src is a full https:// CDN URL.
• Loading PHP at runtime from the network, including "remote updater" patterns.
• Preparing the distributable zip and deciding what ships inside vendor/.
• Merging a snippet taken from Stack Overflow, a blog post, or an AI answer.

Do not reach for this skill for flaws in first-party code: use the output-escaping skill for XSS in your own markup, the capability-permission-checks skill for authorization, and the cron-background-job-security skill for cron callbacks.