What is dependency-remediation?

A security-fix workflow for Node.js projects that links a reported CVE, a software vulnerability identifier, to the affected npm package and a safe fix.

Use it to remediate npm vulnerabilities, update lockfiles, assess upgrade risk, and verify that the project still works.

It helps choose between updating a package, overriding a nested dependency, or changing code while checking for breaking changes and regressions.

dependency-remediation — Skill by aws-samples

About the project

AI-DLC for Modernization Starter Packs is a collection of reusable project templates for applying an AI-driven development lifecycle to application modernization work. Each pack gives teams structured instructions, skills, and agent-tool configurations for use with several coding agents. The catalogue entries are components and tool registrations included in these packs.

aws-samples/sample-ramp-aidlc-mod-starter-packs · 10 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add aws-samples/sample-ramp-aidlc-mod-starter-packs --skill dependency-remediation

Clone the repo

git clone --depth 1 https://github.com/aws-samples/sample-ramp-aidlc-mod-starter-packs

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation/github.svg)](https://agentmods.dev/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation)

Your own site

<a href="https://agentmods.dev/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation"><img src="https://agentmods.dev/badge/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation"><img src="https://agentmods.dev/badge/skills/aws-samples/sample-ramp-aidlc-mod-starter-packs/dependency-remediation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 157 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,012 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin unknown No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00157	$0.02012
Opus 5.5	$0.00063	$0.00805
Sonnet 5.5	$0.00031	$0.00402
Haiku 4.5	$0.00016	$0.00201

Measured 2mo ago against content hash 2b2d8bcea09d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dependency-remediation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills-library/dependency-remediation/SKILL.md · 132 lines

The source is not reproduced here

Licensed MIT-0

The repository is licensed MIT-0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.

Read it on GitHub

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 132 lines · 157 tokens per session scan A 2b2d8bcea09d

Subscribe to this mod's changes

dependency-remediation is a skill published in the GitHub repository aws-samples/sample-ramp-aidlc-mod-starter-packs (10 stars, last pushed yesterday), licensed MIT-0. It adds 157 tokens to every session and 2,012 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.