Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LerianStudio/ring --skill auditing-dependency-securitygit clone --depth 1 https://github.com/LerianStudio/ringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lerianstudio/ring/auditing-dependency-security)<a href="https://agentmods.dev/skills/lerianstudio/ring/auditing-dependency-security"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/auditing-dependency-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lerianstudio/ring/auditing-dependency-security"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/auditing-dependency-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01147 |
| Opus 5.5 | $0.00041 | $0.00459 |
| Sonnet 5.5 | $0.00020 | $0.00229 |
| Haiku 4.5 | $0.00010 | $0.00115 |
Grade A, and why
ring:auditing-dependency-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency Security Check
When to use
- Adding a new dependency to any project
- Running pip install, npm install, go get, or equivalent
- Auditing existing dependencies for supply-chain risk
- Reviewing a PR that adds or updates dependencies
- Investigating a potential supply-chain compromise
Skip when
- No dependencies are being added, updated, or audited
- Task involves only internal code changes with no new imports
- Dependency is already vetted and pinned in lockfile
Related
Complementary: ring:hardening-dockerfiles, ring:implementing-tasks
Supply-chain gate for every install command in a Lerian codebase.
Pre-Install Checks
1. Package Identity Verification
For every package, verify:
├── Typosquatting: compare against known popular packages
│ e.g., "requets" vs "requests", "rnodule" vs "module"
├── Homoglyph attacks: look-alike Unicode characters
├── Maintainer risk:
│ - Single maintainer = higher risk
│ - Account age < 6 months = flag
│ - Recent ownership transfer = CRITICAL flag
└── Package age: < 30 days = flag
2. Vulnerability Database Check
| Source | Ecosystem | What It Covers |
|---|---|---|
| OSV.dev | All | Google aggregated CVEs |
| GitHub Advisory Database | All | GHSA linked to CVEs |
| Socket.dev | npm, pip | Supply-chain: install scripts, network access |
| PyPI JSON API | pip | Metadata, maintainers, release history |
| npm registry API | npm | Metadata, maintainers, install scripts |
| Go vulnerability DB (vuln.go.dev) | Go | Official Go CVE database |
3. Behavioral Signals
| Signal | Risk Level | Description |
|---|---|---|
| Install scripts | HIGH | postinstall (npm), setup.py subprocess |
| Network access at import | CRITICAL | Package phones home on import |
| File system access outside project | HIGH | Reads ~/.ssh, ~/.aws, env vars |
| Obfuscated code | CRITICAL | Base64 payloads, eval(), exec() |
| Native binary bundled | HIGH | Pre-compiled binaries without source |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 132 lines · 102 tokens per session scan A 3b2cc237bf0c
ring:auditing-dependency-security is a skill published in the GitHub repository LerianStudio/ring (217 stars, last pushed 5d ago), licensed Apache-2.0. It adds 102 tokens to every session and 1,147 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rust-skills
Comprehensive Rust coding guidelines with 265 rules across 26 categories. Use when writing, reviewing, or refactoring Rust code. Covers ownership, error handling, async patterns, concurrency, unsafe code, API design, memory optimization, performance, numeric safety, conversions, serde, pattern matching, macros…
content-audit
Content file quality audit across 8 dimensions (CC1-CC8): encoding artifacts (NBSP, mojibake, zero-width), markdown syntax (broken italic, orphan backslash), CMS migration artifacts (Joomla/WordPress/PHP), frontmatter quality, image integrity, link integrity with anchor validation, content completeness, and…
standards
Use this agent when you need to evaluate code, architecture, or development practices against the NASAB framework principles and Rust best practices.
update-deps
Update Python dependencies or pre-commit hooks while preserving the project's pin and configuration style.
verify-language
Language-specific verification for Python, TypeScript/JavaScript, and Go. Checks type safety, language idioms, and best practices. Use when asked to "verify language", "check types", or for language-specific checks.
laravel-audit-conventions
Audit a Laravel application for framework conventions: anti-patterns, version-appropriate APIs, and misuse of framework features. Use when auditing Laravel conventions.