Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add liuxinye23/CyberStrikeAI --skill dependency-risk-reviewgit clone --depth 1 https://github.com/liuxinye23/CyberStrikeAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liuxinye23/cyberstrikeai/dependency-risk-review)<a href="https://agentmods.dev/skills/liuxinye23/cyberstrikeai/dependency-risk-review"><img src="https://agentmods.dev/badge/skills/liuxinye23/cyberstrikeai/dependency-risk-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liuxinye23/cyberstrikeai/dependency-risk-review"><img src="https://agentmods.dev/badge/skills/liuxinye23/cyberstrikeai/dependency-risk-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00744 |
| Opus 5 | $0.00014 | $0.00372 |
| Sonnet 5 | $0.00005 | $0.00149 |
| Haiku 4.5 | $0.00003 | $0.00074 |
Grade A, and why
dependency-risk-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
依赖与供应链风险审计
何时使用
当目标包含应用代码库、镜像、制品、锁文件、构建脚本、包管理器配置或内部依赖仓库时使用本技能。
快速流程
- 确认生态与资产：
package-lock、poetry.lock、requirements、go.sum、镜像清单、制品仓库。 - 区分直接依赖、传递依赖、开发依赖、构建依赖和运行时依赖。
- 审核版本固定策略、来源可信度、过时组件、弃用组件、镜像基线。
- 检查供应链控制：私仓、镜像源、构建签名、最小镜像、变更审计。
重点检查
版本与锁定
- 是否只在描述文件声明范围版本，缺少可重现锁定。
- 关键安全组件是否长时间停留在已弃用或不再维护的版本。
来源与信任
- 是否混用公共源、镜像源、私有包和临时脚本安装。
- 构建链是否依赖未经审计的下载步骤、在线脚本或不稳定镜像。
运行时暴露面
- 运行镜像中是否带入构建工具、测试依赖、调试包和多余 shell。
- 不同环境是否复用同一超大镜像基线。
建议工具
trivy
- 用于依赖、镜像与文件系统层面的已知风险盘点。
- 输出要结合运行环境和组件可达性做二次判断，不要原样搬运漏洞列表。
exec
- 用只读命令核对包管理器文件、锁文件、镜像基线、构建脚本与版本固定策略。
checkov
- 当依赖风险与 IaC、镜像构建、云资源定义耦合时，用来补充配置面问题。
证据要求
- 记录组件名、版本、所在文件、用途、是否直接依赖、是否运行时可达。
- 对高危问题写明“为什么在当前系统里真正重要”。
- 区分可立即修复、需兼容验证、需架构替换三类建议。
修复建议方向
- 固定锁文件并建立更新窗口。
- 缩减运行时镜像与非必要依赖。
- 对公共源、私有源与构建下载流程建立信任边界和审计。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 91 lines · 27 tokens per session scan A bb516593691b
dependency-risk-review is a skill published in the GitHub repository liuxinye23/CyberStrikeAI (0 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 27 tokens to every session and 744 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
full-repo-review
Comprehensive four-wave review of all repo source files, producing a prioritized issue backlog.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…