Dependency risk triage

Skill skyestrela/ai-agent-skill-preview/dependency-risk-triage

Free evidence-first engineering skills for Claude Code, Codex, Hermes, Copilot and the skills CLI

Install

npx -y skills add skyestrela/ai-agent-skill-preview --skill dependency-risk-triage

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

15 days oldThe repository was created 15 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Triage dependency alerts by version, reachability and verified upgrade impact instead of blindly updating everything.

SKILL.md

2.5 KB, 454 tokens by cl100k_base, as published. Nobody here has run it

Dependency Risk Triage

Use this skill when a scanner, advisory or platform reports vulnerable or outdated dependencies.

1. Establish the real dependency state

Inspect the manifest and lockfile. Record package manager, locked version, direct or transitive status and the command that proves it. Do not rely on an old dashboard screenshot.

2. Verify the advisory

Record advisory identifier, affected version range, fixed version and source. Distinguish an official advisory from an unverified post. Check whether the vulnerable package and code path are present in the shipped artifact.

3. Rank practical exposure

For each finding, record:

reachable in production, development-only or unknown;
attacker-controlled input required;
authentication or network boundary;
confidentiality, integrity and availability impact;
existing mitigation;
confidence and missing evidence.

A high scanner score with an unreachable code path is not the same as a proven exploit. An unknown path is not safe; it needs investigation.

4. Choose the smallest safe upgrade

Prefer the minimum supported version that fixes the advisory. Read release and migration notes. Avoid blanket major-version upgrades unless the smaller path is unavailable.

5. Verify in a reversible branch

Update the lockfile in an isolated branch. Run dependency audit, targeted tests, full relevant tests and a build. Compare runtime/bundle behaviour where relevant. Do not deploy automatically.

Output

# Dependency Risk Triage
- Advisory and source:
- Locked / fixed version:
- Direct or transitive:
- Reachability:
- Practical impact:
- Proposed minimum upgrade:
- Tests/build run:
- Result:
- Residual risk or blocker:

Boundaries

Never expose private registry tokens or audit output containing credentials.
Do not mark an advisory fixed because installation succeeded.
Do not delete lockfiles to force a convenient resolution.
Production rollout requires the project's normal approval and rollback process.

More evidence-first workflows

Free source and updates: https://github.com/skyestrela/ai-agent-skill-preview

Complete engineering pack: https://ai-agent-skills-pack.vercel.app/?utm_source=free-skill&utm_medium=github&utm_campaign=dependency-risk-triage