Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Morningstar202604/awesome-skillkit --skill dependency-auditorgit clone --depth 1 https://github.com/Morningstar202604/awesome-skillkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/morningstar202604/awesome-skillkit/dependency-auditor)<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/dependency-auditor"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/dependency-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/morningstar202604/awesome-skillkit/dependency-auditor"><img src="https://agentmods.dev/badge/skills/morningstar202604/awesome-skillkit/dependency-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.02004 |
| Opus 5.5 | $0.00045 | $0.00802 |
| Sonnet 5.5 | $0.00022 | $0.00401 |
| Haiku 4.5 | $0.00011 | $0.00200 |
Grade A, and why
dependency-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to dependency-auditor — 170 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency Auditor
Offline, deterministic dependency audit across 8+ package ecosystems. The three scripts only pattern-match manifests/lockfiles — they do not call online vulnerability-advisory APIs; pair their findings with npm audit / pip-audit / cargo audit to cover the latest CVEs.
Input Checklist
| Input | Required | Description |
|---|---|---|
| Project path | Yes | Repo root, or a directory containing manifests/lockfiles. |
| Output format | No | json (default for the script scenarios) or text. |
| Failure threshold | No | --fail-on-high makes the scanner exit non-zero when a high-level finding appears. |
| Risk threshold (planner) | No | low | medium | high (default medium). |
| Time window (planner) | No | Day window for the upgrade plan (default 90). |
When the project path is missing, ask only once:
Please provide: (1) the project path (the directory containing package.json / requirements.txt / go.mod, etc.). I'll use the rest as defaults: format=json, risk-threshold=medium, timeline=90 days.
Pre-flight Checks
# 1. Are the scripts complete?
test -f scripts/dep_scanner.py && test -f scripts/license_checker.py \
&& test -f scripts/upgrade_planner.py && echo "scripts-ok" \
|| { echo "ERROR: scripts/ missing — bundle incomplete"; exit 1; }
# 2. Is Python available?
command -v python3 >/dev/null 2>&1 || { echo "ERROR: python3 not found"; exit 1; }
# 3. Is there a recognizable manifest in the target directory?
ls "$PROJECT"/*.json "$PROJECT"/go.mod "$PROJECT"/Cargo.toml \
"$PROJECT"/Gemfile "$PROJECT"/pom.xml "$PROJECT"/composer.json 2>/dev/null \
| grep -q . || { echo "WARN: no known manifest found in $PROJECT"; }
Supported Ecosystems (parseable)
| Language | Manifest files parsed |
|---|---|
| JavaScript/Node | package.json, package-lock.json, yarn.lock |
| Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |
| Go | go.mod, go.sum |
| Rust | Cargo.toml, Cargo.lock |
| Ruby | Gemfile, Gemfile.lock |
| Java | pom.xml, gradle.lockfile |
| PHP | composer.json, composer.lock |
| C#/.NET | packages.config, project.assets.json |
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/sample_go.mod 2.1 KB
- assets/sample_package.json 1.9 KB
- assets/sample_requirements.txt 1.1 KB
- expected_outputs/sample_license_report.txt 930 B
- expected_outputs/sample_upgrade_plan.txt 2.0 KB
- expected_outputs/sample_vulnerability_report.json 1.7 KB
- README.md 15 KB
- references/dependency_management_best_practices.md 18 KB
- references/license_compatibility_matrix.md 8.7 KB
- references/vulnerability_assessment_guide.md 14 KB
- scripts/dep_scanner.py 31 KB runs code
- scripts/license_checker.py 43 KB runs code
- scripts/upgrade_planner.py 42 KB runs code
- test-inventory.json 9.7 KB
- test-project/package.json 1.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines · -10 tokens per session 0d514bcf7f44
- 1mo ago Changed e4f9a6703e45
- 1mo ago Changed · +86 lines · +38 tokens per session a53bab2e175a
- 1mo ago First seen · 91 lines · 84 tokens per session scan A 2da2e9983e91
dependency-auditor is a skill published in the GitHub repository Morningstar202604/awesome-skillkit (0 stars, last pushed 25d ago), licensed Apache-2.0. It adds 112 tokens to every session and 2,004 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 88% identical to dependency-auditor, differing in 170 lines, and is treated as a copy.
Other skills, from other repositories
subagent-driven-development
Execute plans via delegatetask subagents (2-stage review).
duckduckgo-search
Free keyless web, news, and image search via ddgs.
safe-refactor
Restructure code while preserving behavior. Use for extraction, consolidation, ownership moves, or cleanup where verification must bracket structural edits.
mem0-oss-to-platform
Plan, then execute, a migration of a project from the mem0 open-source / self-hosted SDK (local Memory class) to the mem0 Platform / hosted SDK (MemoryClient). TRIGGER when: the developer wants to move, switch, or migrate mem0 off OSS/self-hosted to the hosted API, e.g. "migrate my mem0 setup to the platform", "switch…
auditing-subgroup-fairness
Audit an OpenMed NER or de-identification model for performance disparities across demographic subgroups (sex, age band, race/ethnicity when available) using openmed.eval.fairnessreport. Use when the user wants per-subgroup recall and leakage, wants to check whether de-identification under-protects a group, wants to…
memory
Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.