review-dependencies-cf7438 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-dependencies-cf7438 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect package managers and discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Identify which package managers are in use by searching for config files:
| Config file | Package manager | Lockfile | Ecosystem |
|---|---|---|---|
package.json | npm / yarn / pnpm | package-lock.json / yarn.lock / pnpm-lock.yaml | Node.js |
Package.swift, *.xcodeproj | Swift Package Manager | Package.resolved | Swift |
pyproject.toml, requirements.txt, setup.py | pip / poetry / uv | poetry.lock, uv.lock | Python |
Cargo.toml | cargo | Cargo.lock | Rust |
go.mod | Go modules | go.sum | Go |
Gemfile | Bundler | Gemfile.lock | Ruby |
pom.xml | Maven | — | Java |
build.gradle, build.gradle.kts | Gradle | gradle.lockfile | Java/Kotlin |
Swift dependencies can live in Package.swift or be configured directly in the Xcode project file (.xcodeproj/.xcworkspace). For Xcode-managed dependencies, inspect the project's package references.
Detection steps:
yarn.lock → yarn, pnpm-lock.yaml → pnpm)package.json files): use request_user_input to let the user pick one (Codex request_user_input choices are mutually exclusive). For an "all of them" workflow, ask follow-up free-form input or run the review per instance.request_user_input to let the user pick oneRun the appropriate discovery command to find available updates:
| Package manager | Discovery command | Notes |
|---|---|---|
| npm | ncu --format group | Requires npm-check-updates. Suggest npm install -g npm-check-updates if missing. |
| yarn | ncu --format group or yarn upgrade-interactive | |
| pnpm | ncu --format group or pnpm outdated | |
| Swift PM | Check resolved versions in Package.resolved against latest releases via web search | No built-in outdated command. Read Package.swift or inspect the Xcode project to identify dependencies and their current version constraints. |
| pip | pip list --outdated | |
| poetry | poetry show --outdated | |
| uv | uv pip list --outdated | |
| cargo | cargo outdated | Requires cargo-outdated. Fall back to comparing Cargo.toml versions via web search. |
| Go modules | go list -m -u all | |
| Bundler | bundle outdated | |
| Maven | mvn versions:display-dependency-updates | |
| Gradle | gradle dependencyUpdates | Requires com.github.ben-manes.versions plugin. |
Categorize updates:
If the discovery tool is not installed, suggest the installation command (see Step 2 notes column). If no tool exists for the ecosystem, fall back to manual version checking via web search.
If no updates are available, report that dependencies are up to date.
Return findings as a numbered list. For each finding:
### [P<N>] <title (imperative, <=80 chars)>
**Package:** `<name>` <current> -> <latest>
**Manager:** <npm/pip/cargo/etc.>
<one paragraph: why this matters, known vulnerabilities if any, major version gap>After all findings, add:
## Overall Verdict
**Dependencies:** <up to date | updates available>
<summary with counts: N major, N minor, N patch>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.