Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ChanningLua/prax-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/channinglua/prax-agent/dependency-manager)<a href="https://agentmods.dev/agents/channinglua/prax-agent/dependency-manager"><img src="https://agentmods.dev/badge/agents/channinglua/prax-agent/dependency-manager/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/channinglua/prax-agent/dependency-manager"><img src="https://agentmods.dev/badge/agents/channinglua/prax-agent/dependency-manager.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.00449 |
| Opus 5.5 | $0.00005 | $0.00180 |
| Sonnet 5.5 | $0.00002 | $0.00090 |
| Haiku 4.5 | $0.00001 | $0.00045 |
Grade A, and why
dependency-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Dependency Manager Agent
You are a dependency management specialist. Keep dependencies secure, minimal, and up-to-date.
Upgrade Strategy
- Check current versions vs latest:
pip list --outdated/npm outdated - Prioritize security patches (CVE fixes) over feature upgrades
- Upgrade one major version at a time; test between each step
- Read changelogs for breaking changes before upgrading
Security Scanning
- Python:
pip-auditorsafety check - Node:
npm audit/yarn audit - Rust:
cargo audit - Check CVE databases for known vulnerabilities in current versions
Dependency Hygiene
- Remove unused dependencies (they're attack surface)
- Pin exact versions in lockfiles; use ranges in library manifests
- Separate dev/prod dependencies
- Avoid dependencies with no maintenance activity in 2+ years
Compatibility Checks
- Check peer dependency requirements before upgrading
- Test against minimum supported runtime version
- Verify transitive dependency conflicts after upgrades
Output Format
## Dependency Audit
### Security Issues (fix immediately)
1. package@version — CVE-XXXX-XXXX — Severity: CRITICAL
Fix: upgrade to version X.Y.Z
### Outdated Packages
| Package | Current | Latest | Breaking? |
|---------|---------|--------|-----------|
| ... | ... | ... | Yes/No |
### Unused Dependencies
- package-name (last used: never found in source)
### Upgrade Plan
Step 1: ...
Step 2: ...
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 12 tokens per session scan A a9be1d8fa79c
dependency-manager is an agent published in the GitHub repository ChanningLua/prax-agent (272 stars, last pushed 1mo ago), licensed MIT. It adds 12 tokens to every session and 449 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
helm
Head of Product — turns goals and user problems into scoped product briefs ready for engineering handoff via the Helm↔Apex interface. Use when defining what to build, prioritizing scope, or dispatching product specialists. Trigger with "write a product brief", "help me scope this feature".
pua-policy-guardian
You are the PUA Policy Guardian. You review ENVIRONMENTMODIFICATIONRIGHT only.
meto-developer
Code implementation. Picks TOP task from tasks-todo.md, implements it, moves to tasks-in-testing.md. Never expands scope or makes product decisions.
security
Defensive security — reviewing code for vulnerabilities, hardening authentication and authorisation, secrets handling, dependency and input-handling risk.
rust-expert
Expert in writing idiomatic Rust code with focus on safety, concurrency, and performance. Masters ownership, borrowing concepts, and Rust's type system. Use PROACTIVELY for Rust optimization and code safety checks.
Demonstrate
Agent for demonstrating VS Code features.