vet is a software supply-chain security tool that examines open-source packages for malware, vulnerabilities, license issues, and policy violations. Developers use it to scan package manifests, repositories, container images, or SBOMs and to enforce security policies in CI/CD systems.
Borrowing it
Nothing to install: this file belongs to safedep/vet. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/safedep/vet/v2/.claude/skills/vet-commands/SKILL.mdgit clone --depth 1 https://github.com/safedep/vetWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/safedep/vet/vet-commands)<a href="https://agentmods.dev/skills/safedep/vet/vet-commands"><img src="https://agentmods.dev/badge/skills/safedep/vet/vet-commands/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/safedep/vet/vet-commands"><img src="https://agentmods.dev/badge/skills/safedep/vet/vet-commands.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.00405 |
| Opus 5.5 | $0.00030 | $0.00162 |
| Sonnet 5.5 | $0.00015 | $0.00081 |
| Haiku 4.5 | $0.00007 | $0.00040 |
Grade A, and why
vet-commands scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Add or change a vet command
The rules are in docs/DEVGUIDE.md, sections "Command shape" and "Documentation". Read both first.
Steps
- Find the noun that owns the object. Do not add a top-level noun when an existing noun owns it.
- Pick the verb from internal/cmd/verbs.go. A new verb needs a one-line reason in the pull request.
- Write Short and Long for every new command, parent or leaf.
- Write docs/cmd/<path joined with ->.md from the template in the guide. Keep Synopsis and Exit codes.
- Add the row to docs/cmd/README.md in tree order. Do not list commands in the root README.md.
- For a new user-facing guarantee, add an acceptance script and its catalog row.
- Run go test ./internal/cmd/, then make check before the push.
Invariants
- No hyphen in a command name, except the names in
hyphenExceptions. The list holds onlygithub-actions. - The root exceptions are scan, doctor and version. The default answer to a new one is no.
- The top-level set is pinned in the conventions test. A change to it needs the program owner.
- The maximum depth is 3.
- Every leaf has one page, and docs/cmd/README.md links it. Every page has one leaf.
Keep the guide correct
If the code and the guide disagree, fix the guide in the same change. Do not copy rules into this skill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 34 lines · 74 tokens per session scan A 469a47d0b4c2
vet-commands is a skill published in the GitHub repository safedep/vet (1,113 stars, last pushed today), licensed Apache-2.0. It adds 74 tokens to every session and 405 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-10.
Other skills, from other repositories
pr-draft-summary
Draft a concise pull request handoff after substantive repository changes are finished or ready for review. Trigger when wrapping up code, test, script, workflow, release, security, documentation-with-behavior-impact, or template customization changes and the user needs a PR title/body grounded in the real diff…
workflow-validation
Use when validating repository workflows after changes to Docker-first Makefile targets, Dockerfiles, scripts, CI, release packaging, smoke tests, or documentation alignment. Do not use for repo redesign, GitHub-policy-only changes, or instruction-only skill edits with no workflow impact.
supply-chain-security-scanner
AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules, Cargo, and container images. Generates SBOMs (Software Bill of Materials) in SPDX and CycloneDX formats using Syft and Grype. Validates license…
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
debugging-failures
Diagnose a failing Ginkgo suite as an agent — always run with --json-report into a predictable temp/gitignored location, read the terminal verdict line, then use jq to extract structured failure details (name, message, file:line, panic value, captured logs). Covers the panicked-vs-failed trap, panic locations pointing…
tables-and-dynamic-specs
Parameterize and generate Ginkgo specs — DescribeTable/Entry table-driven specs, Entry descriptions (string, nil, closure, EntryDescription), PEntry/FEntry and per-Entry decorators, DescribeTableSubtree, generating specs in a construction-time loop, loading fixtures in TestXxx before RunSpecs, and shared-behavior…