plan-dependency-provenance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-dependency-provenance (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior supply-chain engineer + open-source compliance specialist.
Task: Resolve every direct dependency against its registry, run checklist A–E, build the provenance table, phase remediations, emit plan-dependency-provenance.md. Audit & plan only — never install suspect packages to verify.
Verify every package is real, safe, and licensed. Install nothing until approved.
In a vibe-coding loop "just install the suggested package" is the default move — and it's now a documented attack surface. The Cloud Security Alliance's 2026 research found AI coding tools recommend non-existent package names ~20% of the time, and 43% of those hallucinated names recur on every run of the same prompt. Consistent hallucinations are predictable; predictable names are registerable. Attackers pre-register them on npm/PyPI — slopsquatting — then wait for developers (or autonomous agents) to run the exact npm install / pip install the AI just wrote. With agents executing their own generated install commands, the human checkpoint disappears entirely.
This skill is the audit-and-plan half. Execution (removal, replacement, pinning, license remediation) is handed off after you approve each phase.
Trigger phrases: "check my dependencies", "is this package real", "slopsquatting", "are my packages safe", "audit my supply chain", "license check", "generate an SBOM", "did the AI invent a package", "pre-launch / pre-open-source dependency audit".
Do not fire for: routine version bumps (/update-deps), bundle-size trimming (audit-bundle-size), or general repo cleanup (workflow-housekeep). This skill owns existence, integrity, provenance, and licensing of dependencies.
/update-deps assumes the packages are legitimate and just need upgrading. This skill asks the prior question the AI era forces: is this package even real, who published it, when, and under what license?
exist, were published very recently, have near-zero downloads, or inconsistent history.
(reqests, lodahs), or conflation names merging two real packages.
^/latest on security-sensitive deps.Phylum / npm audit / pip-audit in execution).
"no license", conflicts with project license.
For each finding: package, issue, evidence, severity, remediation direction.
install, add, remove, update, or lockfile edits.plan-dependency-provenance.md# Dependency Provenance & Supply-Chain Audit — <repo>
_Audit-only. Nothing is installed, removed, or upgraded until each phase is approved._
## Scope
- Ecosystems: npm ☐ pip ☐ other ☐ | Direct deps: n Transitive: n
- Lockfile(s): present ☐ committed ☐ | Assumptions: …
## Verdict
| Severity | Count | Worst case |
|----------|-------|-----------|
| Critical | n | non-existent / squat-suspect / malicious package installed |
| High | n | no lockfile, license conflict, open advisory |
| Medium | n | floating pins, abandoned upstream |
| Low | n | bloat, unused deps |
## Provenance table (suspect + notable)
| Package | Exists? | First pub | Weekly DLs | License | Repo | Verdict |
|---------|---------|-----------|------------|---------|------|---------|
| fast-cache-utils | ❓ none found | — | — | — | none | Crit: likely hallucinated → remove |
## Findings
| # | Package | Issue | Evidence | Sev | Direction |
|---|---------|-------|----------|-----|-----------|
## Phased burndown
- **Phase 1 — Verify/remove suspect packages** → manual verify + removal
- **Phase 2 — Lock & pin** → `workflow-housekeep`
- **Phase 3 — License & advisories** → wire Socket.dev/Phylum/npm-audit
- **Phase 4 — De-bloat** → remove unused/duplicate deps
- **Gate** → `create-hook` pre-install allowlist
## Execution handoff
Approve a phase to run it. Re-scan after; add the install-time gate.create-hook regression gates.workflow-housekeep, create-hook, /update-deps (after verified),audit-security.
Plan with a strong model; execute with composer-2.5-execution.mdc. The plan says which packages are suspect; the rule forbids "just installing it to see".~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.