review-dependencies-d874e5 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-dependencies-d874e5 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Identify which package managers are in use by searching for config files:
| Config file | Package manager | Lockfile | Ecosystem |
|---|---|---|---|
package.json | npm / yarn / pnpm | package-lock.json / yarn.lock / pnpm-lock.yaml | Node.js |
Package.swift, *.xcodeproj | Swift Package Manager | Package.resolved | Swift |
pyproject.toml, requirements.txt, setup.py | pip / poetry / uv | poetry.lock, uv.lock | Python |
Cargo.toml | cargo | Cargo.lock | Rust |
go.mod | Go modules | go.sum | Go |
Gemfile | Bundler | Gemfile.lock | Ruby |
pom.xml | Maven | — | Java |
build.gradle, build.gradle.kts | Gradle | gradle.lockfile | Java/Kotlin |
.github/workflows/*.yml / .yaml, action.yml / .yaml | GitHub Actions | — | CI |
Swift dependencies can live in Package.swift or be configured directly in the Xcode project file (.xcodeproj/.xcworkspace). For Xcode-managed dependencies, inspect the project's package references.
Detection steps:
yarn.lock → yarn, pnpm-lock.yaml → pnpm).github/dependabot.yml / .yaml, renovate.json, .github/renovate.json), read it and add every ecosystem it declares to the set found by the config-file searchgh pr list --author app/dependabot (or app/renovate), and mark each upgrade one of them already proposespackage.json files): use AskUserQuestion to let the user choose which to review (multiSelect allowed)AskUserQuestion to let the user choose which to review. Exclude the CI ecosystem from that choice and review it alongside whichever the user picksRun the appropriate discovery command to find available updates:
| Package manager | Discovery command | Notes |
|---|---|---|
| npm | ncu --format group | Requires npm-check-updates. Suggest npm install -g npm-check-updates if missing. |
| yarn | ncu --format group or yarn upgrade-interactive | |
| pnpm | ncu --format group or pnpm outdated | |
| Swift PM | Check resolved versions in Package.resolved against latest releases via WebSearch | No built-in outdated command. Read Package.swift or inspect the Xcode project to identify dependencies and their current version constraints. |
| pip | pip list --outdated | |
| poetry | poetry show --outdated | |
| uv | uv pip list --outdated | |
| cargo | cargo outdated | Requires cargo-outdated. Fall back to comparing Cargo.toml versions via WebSearch. |
| Go modules | go list -m -u all | |
| Bundler | bundle outdated | |
| Maven | mvn versions:display-dependency-updates | |
| Gradle | gradle dependencyUpdates | Requires com.github.ben-manes.versions plugin. |
| GitHub Actions | gh api repos/<owner>/<repo>/releases/latest --jq .tag_name, compared against each uses: ref | No outdated command. Take <owner>/<repo> from the ref's first two path segments. Read a SHA-pinned ref's version from its trailing comment (uses: <owner>/<action>@<sha> # v1.2.3). Compare only the components the ref pins, so @v7 is current against v7.0.1. Fall back to repos/<owner>/<repo>/tags when the release 404s or its tag namespace differs from the ref's, and to WebSearch when the action is not hosted on GitHub. Exclude local (./…), <repo-relative> ($/…), and Docker (docker://…) refs, which pin no release. |
Categorize updates:
If the discovery tool is not installed, suggest the installation command (see Step 2 notes column). If no tool exists for the ecosystem, fall back to manual version checking via WebSearch.
If no updates are available, report that dependencies are up to date. Otherwise, report each update in the output format below, followed by the Overall Verdict.
Then use the TaskList tool and proceed to any remaining task.
Format each finding as:
### [P<N>] <title (imperative, <=80 chars)>
**Package:** `<name>` <current> -> <latest>
**Manager:** <npm/pip/cargo/etc.>
**Proposed:** <open automation PR already covering this upgrade, when one exists>
<one paragraph: why this matters, known vulnerabilities if any, major version gap>After all findings, add:
## Overall Verdict
**Dependencies:** <up to date | updates available>
<summary with counts: N major, N minor, N patch>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.