Dependency Health Check

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.1

Overview

This skill is a transparent dependency-audit checklist, with some commands that should be approved before they install tools or change dependencies.

Install this if you want an agent to help audit project dependencies. Require explicit approval before running package installs, npx tools, `npm audit fix`, `pip-audit --fix`, or dependency removals, and prefer a branch, virtual environment, or container for scans that may touch the network or local tooling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to install and execute additional tooling (`pip install pipreqs`) during analysis. Installing packages as part of a read-only audit expands the attack surface, can execute untrusted package code or dependency hooks, and introduces networked side effects that are not necessary for basic dependency inspection.

VirusTotal

60/60 vendors flagged this skill as clean.