agentsclimarketplace
Sign in

Dependency review

Skill yarlson/yarstack/plugins/yarstack/skills/dependency-review

Review dependency provenance and reproducibility without modifying them. Use when manifests, lockfiles, vendor state, generated dependency state, registries, fetched tools, or version pins change.From its SKILL.md

Install
npx -y skills add yarlson/yarstack --skill dependency-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, 275 tokens by cl100k_base, as published. Nobody here has run it

Dependency Review

Own dependency necessity, provenance, pinning, reproducibility, and generated-state consistency.

Workflow

  1. Confirm the changed dependency surface, comparison target, repository pinning policy, and expected update path.
  2. Establish the consumer and current need for each added, removed, or changed dependency or tool.
  3. Verify manifest, lockfile, vendor, checksum, and generated-state consistency without normalizing unrelated content.
  4. Check provenance, registries, Git sources, floating versions, fetched installers, lifecycle scripts, and reproducibility.
  5. Prefer trusted offline and non-mutating checks. Require explicit authority before network access, installation, cache mutation, lifecycle-script execution, or regeneration.
  6. Delegate exploitability and credentials to security-review, CI machinery to ci-review, infrastructure impact to infra-review, and runtime compatibility to rollout-readiness-review.

Report each finding with location, affected contract, evidence, consequence, smallest correction, verification, and uncertainty. State directly when no actionable finding exists. An evidenced inconclusive result is valid when tooling or provenance is unavailable.

Do not upgrade unrelated dependencies, churn an entire lockfile, add scanners, or trust committed generated code without checking its source.

Finish when each changed dependency is accounted for and residual provenance or reproducibility risk is explicit.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.