[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXDN05CKBWNTH3AJ9MQ969":3,"skill-same:01M6GXDN05CKBWNTH3AJ9MQ969":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6GXDN05CKBWNTH3AJ9MQ969","Dependency Security Review",null,"Deep review of dependency management — supply chain risks, version pinning, vulnerability scanning, lock file integrity, and transitive dependency audit.","malayvuong\u002Fagent-orchestra","malayvuong","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13240975?v=4","01M6GXCDVPB2VPZMDZK1KF98M0","Nguyen Minh Vuong","01M6GXCE176VDX3XV4Z4KNR33J",1,"MIT","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fdependency-security\u002FSKILL.md",[],[19,5,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"dependency","dependency security","review","security review","security","file","cve","vulnerability","dependency management","version","scanning","package","supply chain","deep","cargo","chain","supply","lock","pip","2026-11-10 10:12:30",false,"---\nname: Dependency Security Review\ndescription: Deep review of dependency management — supply chain risks, version pinning, vulnerability scanning, lock file integrity, and transitive dependency audit.\nversion: 2026.3.1\nlicense: MIT\ntriggers:\n  lenses:\n    - security\n  keywords:\n    - dependency\n    - package\n    - npm\n    - pip\n    - cargo\n    - vulnerability\n    - cve\n    - supply chain\n---\n\nWhen reviewing dependency management, apply the following checks.\n\n## Lock File Integrity\n\nVerify a lock file exists and is committed to the repository (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `Pipfile.lock`, `poetry.lock`, `Cargo.lock`, `go.sum`). Flag repositories without a committed lock file — builds are non-reproducible and vulnerable to supply chain substitution.\n\nFlag `.gitignore` entries that exclude lock files. Verify CI installs with the frozen lock file (`npm ci`, `pnpm install --frozen-lockfile`, `pip install --require-hashes`) — not `npm install` which can modify the lock file.\n\nCheck that lock file changes in PRs are reviewed — a modified lock file can introduce malicious packages. Flag PRs that modify the lock file without a corresponding change to the package manifest.\n\n## Version Pinning\n\nFlag wildcard version specifiers (`*`, `latest`) in production dependencies. Verify direct dependencies use exact versions or tight ranges (`^` for npm is acceptable if lock file is committed, but `>=` without upper bound is not).\n\nFlag `npm install \u003Cpackage>` without `--save-exact` in installation instructions — default `^` ranges allow minor version drift between installs. Check that renovate\u002Fdependabot is configured for automated dependency updates with CI verification.\n\n## Typosquatting and Substitution\n\nCheck package names for common typosquatting patterns: extra hyphens (`lodash` vs `lodash-utils`), character substitution (`express` vs `expresss`), scope confusion (`@types\u002Freact` vs `@typos\u002Freact`). Flag new dependencies added in a PR that have fewer than 1000 weekly downloads or were published within the last 30 days without explicit justification.\n\nFlag `install` or `postinstall` scripts in dependencies — these execute arbitrary code at install time. Verify `ignore-scripts` is configured for untrusted packages.\n\n## Known Vulnerabilities\n\nVerify `npm audit`, `pip audit`, `cargo audit`, or equivalent is run in CI. Flag dependencies with known critical or high severity CVEs. Check that vulnerability scanning covers transitive dependencies, not just direct ones — most vulnerabilities come from deep in the dependency tree.\n\nFlag dependencies that are unmaintained (no commits in 2+ years, no response to security issues) — these will never get security patches. Identify alternatives for abandoned packages.\n\n## Transitive Dependency Risk\n\nFlag dependency trees with more than 500 total packages — large trees increase attack surface. Check for duplicate packages at different versions (e.g., two versions of `lodash`) — this increases bundle size and may indicate diamond dependency conflicts.\n\nVerify `peerDependencies` are satisfied — unmet peer dependencies can cause runtime failures. Flag `--legacy-peer-deps` or `--force` in install commands — these hide real compatibility issues.\n\n## License Compliance\n\nVerify all dependencies have licenses compatible with the project's license. Flag `AGPL` dependencies in proprietary projects — AGPL requires disclosing the entire application source. Flag dependencies without a license — the default copyright applies, meaning the dependency cannot be legally redistributed.\n\nCheck for license changes between versions — a dependency that was MIT in v1 may become proprietary in v2. Verify license scanning is part of CI.\n\n## Build and Bundle\n\nFlag development dependencies (`devDependencies`) that are imported in production code — these may not be installed in production builds. Verify `npm prune --production` or equivalent is used for production deployments.\n\nCheck bundle size impact for frontend dependencies: flag packages larger than 100KB gzipped that have smaller alternatives. Verify tree-shaking is effective — flag dependencies that do not support ES modules and force the entire package to be bundled.\n\nFor each finding, report: the package name and version, the specific risk, and the recommended action.\n","When reviewing dependency management, apply the following checks.\n\n## Lock File Integrity\n\nVerify a lock file exists and is committed to the repository (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `Pipfile.lock`, `poetry.lock`, `Cargo.lock`, `go.sum`). Flag repositories without a committed lock file — builds are non-reproducible and vulnerable to supply chain substitution.\n\nFlag `.gitignore` entries that exclude lock files. Verify CI installs with the frozen lock file (`npm ci`, `pnpm install --frozen-lockfile`, `pip install --require-hashes`) — not `npm install` which can modify the lock file.\n\nCheck that lock file changes in PRs are reviewed — a modified lock file can introduce malicious packages. Flag PRs that modify the lock file without a corresponding change to the package manifest.\n\n## Version Pinning\n\nFlag wildcard version specifiers (`*`, `latest`) in production dependencies. Verify direct dependencies use exact versions or tight ranges (`^` for npm is acceptable if lock file is committed, but `>=` without upper bound is not).\n\nFlag `npm install \u003Cpackage>` without `--save-exact` in installation instructions — default `^` ranges allow minor version drift between installs. Check that renovate\u002Fdependabot is configured for automated dependency updates with CI verification.\n\n## Typosquatting and Substitution\n\nCheck package names for common typosquatting patterns: extra hyphens (`lodash` vs `lodash-utils`), character substitution (`express` vs `expresss`), scope confusion (`@types\u002Freact` vs `@typos\u002Freact`). Flag new dependencies added in a PR that have fewer than 1000 weekly downloads or were published within the last 30 days without explicit justification.\n\nFlag `install` or `postinstall` scripts in dependencies — these execute arbitrary code at install time. Verify `ignore-scripts` is configured for untrusted packages.\n\n## Known Vulnerabilities\n\nVerify `npm audit`, `pip audit`, `cargo audit`, or equivalent is run in CI. Flag dependencies with known critical or high severity CVEs. Check that vulnerability scanning covers transitive dependencies, not just direct ones — most vulnerabilities come from deep in the dependency tree.\n\nFlag dependencies that are unmaintained (no commits in 2+ years, no response to security issues) — these will never get security patches. Identify alternatives for abandoned packages.\n\n## Transitive Dependency Risk\n\nFlag dependency trees with more than 500 total packages — large trees increase attack surface. Check for duplicate packages at different versions (e.g., two versions of `lodash`) — this increases bundle size and may indicate diamond dependency conflicts.\n\nVerify `peerDependencies` are satisfied — unmet peer dependencies can cause runtime failures. Flag `--legacy-peer-deps` or `--force` in install commands — these hide real compatibility issues.\n\n## License Compliance\n\nVerify all dependencies have licenses compatible with the project's license. Flag `AGPL` dependencies in proprietary projects — AGPL requires disclosing the entire application source. Flag dependencies without a license — the default copyright applies, meaning the dependency cannot be legally redistributed.\n\nCheck for license changes between versions — a dependency that was MIT in v1 may become proprietary in v2. Verify license scanning is part of CI.\n\n## Build and Bundle\n\nFlag development dependencies (`devDependencies`) that are imported in production code — these may not be installed in production builds. Verify `npm prune --production` or equivalent is used for production deployments.\n\nCheck bundle size impact for frontend dependencies: flag packages larger than 100KB gzipped that have smaller alternatives. Verify tree-shaking is effective — flag dependencies that do not support ES modules and force the entire package to be bundled.\n\nFor each finding, report: the package name and version, the specific risk, and the recommended action.\n",{"name":5,"license":15,"version":43,"triggers":44,"description":7},"2026.3.1",{"lenses":45,"keywords":46},[23],[19,30,47,37,33,26,25,31],"npm","main","eac6069a8690d89fd23f08d2d14e4874ed376a77",".agent-orchestra\u002Fskills\u002Fdependency-security",0,"https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra","https:\u002F\u002Fgithub.com\u002Fmalayvuong","www.malayvuong.com","Just a newbie at everything","2026-10-09 12:52:45",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add malayvuong\u002Fagent-orchestra --skill \"Dependency Security Review\"",{"tool":63,"command":64},"bunx","bunx skills add malayvuong\u002Fagent-orchestra --skill \"Dependency Security Review\"",{"tool":66,"command":67},"pnpm","pnpm dlx skills add malayvuong\u002Fagent-orchestra --skill \"Dependency Security Review\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fdependency-security\u002FSKILL.md",true,[],[72,113,133,151,175,194],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":94,"publishedAt":38},"01M6GXHYPRJ43SHFPFJTF87GS8","Vue.js Review","Deep review of Vue.js applications — Composition API patterns, reactivity traps, component design, Pinia state management, and performance pitfalls.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fvue-review\u002FSKILL.md",[78,83,86,89],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":84,"categoryName":85,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":87,"categoryName":88,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":90,"categoryName":91,"taxonomyType":92,"taxonomyTypeDesc":93},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[21,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,32,110,111,112],"vue","js","Vue js Review","design","performance","component","state management","state","deep review","api patterns","applications","api","Composition","pinia","management","logic","pitfalls","pinia state",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":38},"01M6GXHSPDDH1PQEN61ENMCEF5","Unity Review","Deep review of Unity C# code — object pooling, Update allocation, physics patterns, UI performance, serialization, and mobile optimization.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Funity-review\u002FSKILL.md",[],[21,120,115,99,121,122,103,123,124,125,126,127,128,32,110,129,130,131,132],"unity","update","code","ui","serialization","Optimization","mobile","patterns","physics","C#","mobile optimization","object","allocation",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":38},"01M6GXHNKTH12CGSRWDGF2H1Q9","TypeScript Review","Deep review of TypeScript code — type safety, generics patterns, strict mode compliance, type narrowing, module boundaries, and common escape hatches.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftypescript-review\u002FSKILL.md",[],[21,140,141,122,103,142,143,144,145,127,32,110,146,147,148,149,150],"typescript","typescript review","compliance","Type Safety","Safety","common","module","type","interface","consistency","mode",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":163,"publishedAt":38},"01M6GXHH3DMZD272RVH4800C67","Test Conventions","Testing patterns and conventions for code review. Covers naming, AAA structure, boundary testing, mock vs real dependencies, and coverage expectations.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftest-conventions\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":161,"categoryName":162,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000008","测试与质量",[164,165,153,166,167,21,122,168,169,170,127,171,172,173,174],"test","conventions","code review","testing","testing patterns","boundary","coverage","dependencies","structure","mock","naming",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":38},"01M6GXHCAQSJDVNVRFFD1HJWTN","Terraform Review","Deep review of Terraform\u002FOpenTofu configuration — state management, module design, security hardening, drift prevention, and production safety patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fterraform-review\u002FSKILL.md",[181,184],{"categoryNo":182,"categoryName":183,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":87,"categoryName":88,"taxonomyType":81,"taxonomyTypeDesc":82},[21,186,177,98,23,101,102,103,187,188,189,190,144,191,109,192,193,32,110,146],"terraform","cloud","aws","hardening","Production","opentofu","iac","drift",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":38},"01M6GXH83F11CK4BQEAJPN6HDE","Swift Review","Deep review of Swift code — memory management, concurrency patterns, optionals, protocol design, SwiftUI lifecycle, and iOS platform patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fswift-review\u002FSKILL.md",[200],{"categoryNo":87,"categoryName":88,"taxonomyType":81,"taxonomyTypeDesc":82},[202,21,196,98,203,99,122,204,103,205,206,207,208,209,109,32,110,210,211,212],"swift","memory","protocol","ios","concurrency","lifecycle","swiftui","uikit","xcode","apple","platform"]