Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcoguillermaz/Tierward --skill dependency-auditgit clone --depth 1 https://github.com/marcoguillermaz/TierwardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcoguillermaz/tierward/dependency-audit)<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/dependency-audit"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/dependency-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/dependency-audit"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/dependency-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00133 | $0.02990 |
| Opus 5 | $0.00067 | $0.01495 |
| Sonnet 5 | $0.00027 | $0.00598 |
| Haiku 4.5 | $0.00013 | $0.00299 |
Grade A, and why
dependency-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are performing a dependency update audit on the current project. The skill is read-only by default: it produces a decision report; it never modifies package.json, lockfiles, or any source.
Step 0 — Stack detection + scope resolution
Detect the project stack from the manifest file present at the project root:
| Manifest | Stack | Inventory command |
|---|---|---|
package.json |
node-ts / node-js | npm outdated --json (or pnpm outdated --format json if pnpm-lock.yaml exists) |
pyproject.toml or requirements.txt |
python | pip list --outdated --format=json (or uv pip list --outdated --format json if uv.lock exists) |
Package.swift |
swift | swift package show-dependencies --format json + manual upstream check |
Cargo.toml |
rust | cargo outdated --format json (requires cargo-outdated; fall back to cargo update --dry-run if absent) |
go.mod |
go | go list -u -m -json all |
Gemfile |
ruby | bundle outdated --parseable |
pom.xml or build.gradle* |
java / kotlin | Maven versions:display-dependency-updates or Gradle dependencyUpdates |
*.csproj |
dotnet | dotnet list package --outdated --format json |
If the manifest is absent or unrecognized, STOP and report not applicable: stack not detected.
If a sibling PATTERNS.md exists for the detected stack, load it for tier classification. Otherwise apply only the agnostic Tier rules in this body.
Parse $ARGUMENTS for tier: and pkg: filters.
| Filter | Behavior |
|---|---|
tier:A / tier:B / tier:C |
Restrict the report to one tier. |
pkg:<name> |
Drill into a single package: full changelog fetch + grep of API surface in the codebase. |
| (no filter) | Full report across all tiers. |
Tier definitions (agnostic)
Tier A — Safe (patch + minor on non-breaking lib):
- Patch versions on any package.
- Minor versions on packages whose changelog explicitly declares no breaking changes AND no API consumed by the project is removed.
- Failure mode: nearly never breaks; recoverable in seconds.
- Action: batch in a single PR.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 228 lines · 133 tokens per session scan A 81d9182237b6
dependency-audit is a skill published in the GitHub repository marcoguillermaz/Tierward (4 stars, last pushed 3d ago), licensed MIT. It adds 133 tokens to every session and 2,990 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
harness-engineering
Use when the user asks to improve, fix, or build their repository's AI harness — AGENTS.md, rules, skills, commands, hooks, guardrails, CI sensors — or to act on harness-score audit findings and raise their maturity level.
codex-hud
Show Codex workspace context with local config, git state, hooks, and project hints. Standalone mode can show an expanded snapshot; patched Codex TUI footer mode is single-line. Use when the user says "codex-hud", "show Codex HUD", "status HUD", "workspace snapshot", or asks for richer Codex context.
address-conductor-comment
A workflow for handling pending Conductor code-review comments, including reading their discussion and assigning changes to subagents when appropriate.
explain-comment
A skill that reads a specified file or code range and adds explanatory comments in Japanese. The comments use a question style and focus on important logic, design choices, and side effects.
saleae-mcp-debugger
Use this skill for hardware-in-the-loop firmware capture and decode workflows through the Saleae Logic 2 MCP server.
build-feature
Full pipeline: evaluation -> spec -> implementation -> review -> QA.