Deps
Claude Code skills for git workflows, GitHub automation, security audits, code refactoring, and project tooling
npx -y skills add tartinerlabs/skills --skill depsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when hardening a dependency supply chain, pinning versions, adding registry/security flags, or setting up Renovate. Detects the language and locks down install scripts, versions, and CI checks (JS/TS, Python, Go, Rust).
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.8 KB, as published. Nobody here has run it
You harden dependency supply-chain security. Detect the project's language, then auto-detect what's already configured and apply only missing hardening measures for that ecosystem.
0. Detect Language and Route
Detect the project's language from its manifest, then follow the matching hardening guide:
| Language | Detected by | Hardening guide |
|---|---|---|
| JS/TS | package.json | the rules/*.md files below (.npmrc flags · pinning · release quarantine · Renovate · dependency review · package runner) |
| Python | pyproject.toml, requirements*.txt, setup.py | references/python.md (pin + hashes · pip-audit · Renovate/Dependabot · dependency review) |
| Go | go.mod | references/go.md (go mod verify · govulncheck · checksum DB · dependency review) |
| Rust | Cargo.toml | references/rust.md (commit Cargo.lock · cargo audit/cargo-deny · source policy · dependency review) |
Load only the guide for the detected language. For a language not listed (e.g. Ruby → bundler-audit), apply the same shape — pin versions, scan for vulnerabilities, automate updates, gate PRs — and note that first-class support for it is not yet bundled.
The rest of this file (Steps 1-4) is the JS/TS path. For Python, Go or Rust, follow the referenced guide, then use the shared summary format in Step 4.
1. Detect Package Manager
Detect the package manager from the lockfile, in this order: pnpm-lock.yaml, bun.lock/bun.lockb, yarn.lock, package-lock.json. With no lockfile, ask.
Use the detected package manager for all commands. Replace <pm> in rule files with the detected manager.
2. Detect Existing Config
Before applying any hardening, scan for existing configurations:
.npmrc/.yarnrc.yml/bunfig.toml→ package manager config already present (check individual flags)renovate.json/.renovaterc/.renovaterc.json/renovatekey inpackage.json→ Renovate already configured.github/workflows/*.{yml,yaml}containingdependency-review→ dependency review existspackage.jsondependency versions without^or~prefixes → already pinned
Skip rules whose checks already pass. Report what was skipped at the end.
3. Apply Rules
Read each rule file for detailed instructions and config templates.
| Rule | Impact | File |
|---|---|---|
| .npmrc security flags | HIGH | rules/npmrc.md |
| Release quarantine | MEDIUM | rules/release-quarantine.md |
| Version pinning | HIGH | rules/version-pinning.md |
| Renovate | MEDIUM | rules/renovate.md |
| Dependency review | HIGH | rules/dependency-review.md |
| Package runner | MEDIUM | rules/package-runner.md |
4. Output Summary
After all rules are processed, display a summary:
## Supply Chain Hardening Complete
### Applied
- [list of rules applied with brief description]
### Skipped (already configured)
- [list of rules skipped with reason]
### Manual Steps Required
- [any post-setup steps, e.g. "Run `pnpm exec husky` to reinitialise git hooks"]