Deps

Use when hardening a dependency supply chain, pinning versions, adding registry/security flags, or setting up Renovate. Detects the language and locks down install scripts, versions, and CI checks (JS/TS, Python, Go, Rust).From its SKILL.md

Install

npx -y skills add tartinerlabs/skills --skill deps

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.8 KB, 786 tokens by cl100k_base, as published. Nobody here has run it

You harden dependency supply-chain security. Detect the project's language, then auto-detect what's already configured and apply only missing hardening measures for that ecosystem.

0. Detect Language and Route

Detect the project's language from its manifest, then follow the matching hardening guide:

Language	Detected by	Hardening guide
JS/TS	`package.json`	the `rules/*.md` files below (`.npmrc` flags · pinning · release quarantine · Renovate · dependency review · package runner)
Python	`pyproject.toml`, `requirements*.txt`, `setup.py`	`references/python.md` (pin + hashes · pip-audit · Renovate/Dependabot · dependency review)
Go	`go.mod`	`references/go.md` (`go mod verify` · govulncheck · checksum DB · dependency review)
Rust	`Cargo.toml`	`references/rust.md` (commit `Cargo.lock` · cargo audit/cargo-deny · source policy · dependency review)

Load only the guide for the detected language. For a language not listed (e.g. Ruby → bundler-audit), apply the same shape — pin versions, scan for vulnerabilities, automate updates, gate PRs — and note that first-class support for it is not yet bundled.

The rest of this file (Steps 1-4) is the JS/TS path. For Python, Go or Rust, follow the referenced guide, then use the shared summary format in Step 4.

1. Detect Package Manager

Detect the package manager from the lockfile, in this order: pnpm-lock.yaml, bun.lock/bun.lockb, yarn.lock, package-lock.json. With no lockfile, ask.

Use the detected package manager for all commands. Replace <pm> in rule files with the detected manager.

2. Detect Existing Config

Before applying any hardening, scan for existing configurations:

.npmrc / .yarnrc.yml / bunfig.toml → package manager config already present (check individual flags)
renovate.json / .renovaterc / .renovaterc.json / renovate key in package.json → Renovate already configured
.github/workflows/*.{yml,yaml} containing dependency-review → dependency review exists
package.json dependency versions without ^ or ~ prefixes → already pinned

Skip rules whose checks already pass. Report what was skipped at the end.

3. Apply Rules

Read each rule file for detailed instructions and config templates.

Rule	Impact	File
.npmrc security flags	HIGH	`rules/npmrc.md`
Release quarantine	MEDIUM	`rules/release-quarantine.md`
Version pinning	HIGH	`rules/version-pinning.md`
Renovate	MEDIUM	`rules/renovate.md`
Dependency review	HIGH	`rules/dependency-review.md`
Package runner	MEDIUM	`rules/package-runner.md`

4. Output Summary

After all rules are processed, display a summary:

## Supply Chain Hardening Complete

### Applied
- [list of rules applied with brief description]

### Skipped (already configured)
- [list of rules skipped with reason]

### Manual Steps Required
- [any post-setup steps, e.g. "Run `pnpm exec husky` to reinitialise git hooks"]

What ships with it: 9 files

20.6 KB alongside SKILL.md

references/

go.md2.6 KB
python.md3.6 KB
rust.md3.5 KB

rules/

Gives 0 of the 12 instructions most security skills give in 786 tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accessin 82 of 666, across 79 files
Hash passwords with BCryptin 55 of 666, across 39 files
Implement rate limiting for public endpointsin 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputin 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

detect project language from manifest
load hardening guide for detected language
check package manager field in manifest
scan for existing configuration files
skip rules whose checks already pass
apply missing hardening measures

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.