Security audit
Security checks for vulnerabilities and agentic risk
The skill appears locally scoped and non-persistent, but it overstates security coverage in ways that could give users false confidence in lockfile audits.
Install only if you treat it as a helper for limited local review, not as a complete supply-chain security gate. Be especially cautious with non-npm ecosystems and approve any lockfile regeneration, npm install, or CI-gate changes manually after reviewing the diff.
Advertising support for yarn.lock, pnpm-lock.yaml, and Pipfile.lock without implementing substantive checks can cause users to rely on the skill for supply-chain validation that never actually occurs. In a security auditing context, silent coverage gaps are dangerous because they can mask lockfile tampering or drift and lead to incorrect assurance in CI or manual review.
Advertising support for yarn.lock, pnpm-lock.yaml, and Pipfile.lock without implementing substantive checks can cause users to rely on the skill for supply-chain validation that never actually occurs. In a security auditing context, silent coverage gaps are dangerous because they can mask lockfile tampering or drift and lead to incorrect assurance in CI or manual review.
Advertising support for yarn.lock, pnpm-lock.yaml, and Pipfile.lock without implementing substantive checks can cause users to rely on the skill for supply-chain validation that never actually occurs. In a security auditing context, silent coverage gaps are dangerous because they can mask lockfile tampering or drift and lead to incorrect assurance in CI or manual review.
This markdown skill manifest includes trigger phrases, and "supply chain check" is generic enough that it could match ordinary conversation about software security rather than a specific request to run this skill. The file does list several specific triggers, but this broad phrase lacks narrowing context or negative examples to constrain activation.
The documentation tells users that npm ci --dry-run is an exact lockfile/manifest consistency gate, but the generated CI logic actually relies on brittle output matching with grep and a fallback npm install --dry-run path. In a security gate, inaccurate guidance can cause false passes or inconsistent enforcement, letting stale or manipulated lockfiles slip through CI unnoticed.
