Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/adonai-labs/agent-runwayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/adonai-labs/agent-runway/dependency-check)<a href="https://agentmods.dev/rules/adonai-labs/agent-runway/dependency-check"><img src="https://agentmods.dev/badge/rules/adonai-labs/agent-runway/dependency-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/adonai-labs/agent-runway/dependency-check"><img src="https://agentmods.dev/badge/rules/adonai-labs/agent-runway/dependency-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00550 |
| Opus 5.5 | $0.00000 | $0.00220 |
| Sonnet 5.5 | $0.00000 | $0.00110 |
| Haiku 4.5 | $0.00000 | $0.00055 |
Grade A, and why
dependency-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
When I ask "dependency health" (or similar), do all of the following:
- Detect unused dependencies
npm run depcheck
Parse the JSON:
dependencies→ list of unused production depsusing→ map of used deps to file locationsinvalidFiles→ note any config parsing issues
- Check security advisories
npm audit --json
For each vulnerability, record:
- Package name and severity (critical, high, moderate, low, info)
- Whether it's direct or indirect dependency
- Recommended fix version (if available)
- Manual cross-check for common missed packages
Check these packages that depcheck often misses:
date-fns(used in calendar components)zod(schema validation)react-flow-renderervsreactflow(version conflicts)
- Produce dependency analysis table
| Package | Used? | Where Found / Status | Security Advisories (severity) |
|---|---|---|---|
| [package] | ✅/❌ | Location or "Not found" | Advisory details |
| Overall Score | X / 10 |
Score calculation:
- Start at 10
- -1 for each unused production dependency
- -2 for each "info" or "low" advisory
- -3 for each "moderate" advisory
- -4 for each "high" advisory
- -5 for each "critical" advisory
- Floor at 1, cap at 10
- List concrete remediation steps
Examples:
npm uninstall <unused-pkg>npm update <pkg>@latestnpm audit fix- Move dev tools from dependencies to devDependencies
Special considerations for your Vite+React setup:
- Check for UI component library usage (@radix-ui/*)
- Verify 3D library usage (@react-three/*)
- Look for duplicate React Flow packages
- Ensure dev tools are in devDependencies
Notes:
- Only consider production dependencies for unused package scoring
- For dynamic imports, add
/* depcheck: ignore */near the import - Check both automatic and manual analysis for completeness
- Fix TypeScript config syntax errors that may affect depcheck
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 77 lines · 0 tokens per session scan A 19c4307bf294
dependency-check is a cursor rule published in the GitHub repository adonai-labs/agent-runway (2 stars, last pushed 20d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 550 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
optimize-dry-solid-principles-cursorrules-prompt-f
Cursor rules for optimization development with DRY and SOLID principles integration.
agent-master
Meta-orchestrator that classifies tasks and routes to the right combination of installed skills across caveman (output compression), superpowers (dev workflow), anthropic-skills (business/domain expertise), and wired tactical libraries (wshobson, davila7, impeccable, anthropic-official, rea). 27 routing categories…
ai-dev-os-review
Performs a comprehensive self-review before creating a PR. Combines guideline compliance checking (L3) with design-level review (L2) and philosophical alignment (L1). Unlike @ai-dev-os-check which only checks rules, this also evaluates architecture decisions and code design quality.
Accessibility-Review
Reviews web interfaces, content, or code snippets for common accessibility (a11y) issues based on WCAG guidelines, ensuring usability for people with disabilities.
standard-agent-quality
A set of rules for checking development work before it is marked complete. It defines success checks such as a clean linter, cross-checking, and challenging the result.
reduce_method_arguments
A method should limit the number of arguments it accepts. If a method has more than three arguments, consider grouping them into a single parameter object to reduce complexity and improve clarity.