Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wu529778790/shenzjd-skills --skill dependency-auditgit clone --depth 1 https://github.com/wu529778790/shenzjd-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wu529778790/shenzjd-skills/dependency-audit)<a href="https://agentmods.dev/skills/wu529778790/shenzjd-skills/dependency-audit"><img src="https://agentmods.dev/badge/skills/wu529778790/shenzjd-skills/dependency-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wu529778790/shenzjd-skills/dependency-audit"><img src="https://agentmods.dev/badge/skills/wu529778790/shenzjd-skills/dependency-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01238 |
| Opus 5 | $0.00016 | $0.00619 |
| Sonnet 5 | $0.00007 | $0.00248 |
| Haiku 4.5 | $0.00003 | $0.00124 |
Grade A, and why
dependency-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency Audit
扫描项目依赖，检测安全漏洞、过时包和 license 合规问题。
Overview
全面审计项目依赖：CVE 漏洞扫描、过时依赖检测、license 合规检查、重复依赖分析。输出按严重程度排序的安全报告和可执行的修复命令。
When to Use
- User wants to check dependency security
- User mentions CVE, vulnerability, or audit
- User wants to know outdated dependencies
- User says "审计依赖" / "check dependencies"
- User inputs
/dependency-audit
When NOT to Use:
- User only wants to update versions
- User wants code-level security review
- User wants to analyze runtime dependencies
- User wants deep license analysis
- User wants to scan Docker images
Core Pattern
Step 1: 检测包管理器
| 检测文件 | 包管理器 | 审计命令 |
|---|---|---|
package-lock.json |
npm | npm audit |
yarn.lock |
yarn | yarn audit |
pnpm-lock.yaml |
pnpm | pnpm audit |
go.sum |
Go | govulncheck ./... |
requirements.txt / Pipfile.lock |
Python | pip-audit |
Cargo.lock |
Rust | cargo audit |
Step 2: 漏洞扫描
# 工具可用性检查（所有步骤共用）
check_tool() {
command -v "$1" >/dev/null 2>&1 || { echo "⚠️ $1 未安装，跳过 $2 审计"; return 1; }
}
核心命令（按包管理器分别执行，缺失工具自动跳过）：
⚠️
npm audit在发现漏洞时退出码非 0 —— 不要用if npm audit ...; then判断成功，直接解析--json输出：
| 包管理器 | 审计命令 |
|---|---|
| npm | npm audit --json | jq '.metadata.vulnerabilities.total' → 解析 vulnerabilities 数量 + 严重程度（勿依赖退出码） |
| Go | govulncheck ./... → 安装 golang.org/x/vuln/cmd/govulncheck@latest |
| Python | pip-audit → 安装: pip install pip-audit |
输出：漏洞总数 + 按严重程度（critical/high/medium/low）分类的 CVE 列表。
Step 3: 过时依赖检测
核心命令（按包管理器分别执行，缺失工具自动跳过）：
| 包管理器 | 检测命令 |
|---|---|
| npm | npx npm-check-updates --format table |
| Go | go list -m -u all | grep "\[" |
| Python | pip list --outdated |
统计：过时依赖数量、major/minor/patch 升级分布、是否有安全相关更新。
Step 4: License 合规检查
核心命令（按包管理器分别执行）：
| 包管理器 | 检测命令 |
|---|---|
| npm | npx license-checker --json → 按许可证类型统计数量 |
| Go | go-licenses csv ./... → 安装: go install github.com/google/go-licenses@latest |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 121 lines · 33 tokens per session scan A b94c2edfd31b
dependency-audit is a skill published in the GitHub repository wu529778790/shenzjd-skills (0 stars, last pushed 3d ago), licensed MIT. It adds 33 tokens to every session and 1,238 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dialogue-manager
Use when using the Dialogue Manager addon — .dialogue files with titles, responses, conditions and mutations, runtime balloons, and C# support.
limboai
Use when using the LimboAI addon — behavior trees and hierarchical state machines (C++ GDExtension) with a visual editor, BTTask subclassing, and a blackboard.
localization
Use when implementing localization (i18n/l10n) — TranslationServer, CSV/PO translation files, locale switching, RTL support, and pluralization in Godot 4.3+.
dedicated-server
Use when building dedicated servers — headless export, server architecture, lobby management, and deployment.
event-bus
Use when implementing decoupled communication between nodes — global EventBus autoload with typed signals.
physics-system
Use when working with physics bodies, collision shapes, raycasting, areas, rigid bodies, ragdolls, soft bodies, Jolt physics, and physics interpolation in Godot 4.3+.