[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6X04RAZNDY9V630779XJRSC":3,"skill-same:01M6X04RAZNDY9V630779XJRSC":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":14,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6X04RAZNDY9V630779XJRSC","dependency-audit",null,"Audit project dependencies for vulnerabilities and outdated packages. Use when checking the security posture of dependencies, planning updates, or running a pre-release dependency review.","projectious-work\u002Fprocesskit","projectious-work","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F263889726?v=4","01M6N97TJJ118WQ35CHRV8RD0E","projectious.work","01M6N97TPWJPF0BMKYQ4PBY5W8",0,"MIT","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.18.2\u002Fcontext\u002Fskills\u002Fengineering\u002Fdependency-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"audit","dependency audit","dependency","use","running","when","for","v1","updates","project","security posture","dependencies","review","work","engineering","release","planning","packages","vulnerabilities","security","2026-11-10 10:12:30",false,"---\nname: dependency-audit\ndescription: |\n  Audit project dependencies for vulnerabilities and outdated packages. Use when checking the security posture of dependencies, planning updates, or running a pre-release dependency review.\nmetadata:\n  processkit:\n    apiVersion: processkit.projectious.work\u002Fv1\n    id: SKILL-dependency-audit\n    version: \"1.1.0\"\n    created: 2026-04-06T00:00:00Z\n    category: engineering\n---\n\n# Dependency Audit\n\n## Intro\n\nThird-party dependencies are the largest part of most codebases'\nattack surface. A dependency audit runs the ecosystem's vulnerability\nscanner, triages findings by severity, and produces a concrete update\nplan.\n\n## Overview\n\n### Run the right tool\n\nEach ecosystem ships its own audit command:\n\n| Ecosystem | Audit command                       | Outdated check          |\n|-----------|-------------------------------------|-------------------------|\n| Rust      | `cargo audit`                       | `cargo outdated`        |\n| Python    | `pip-audit` or `safety check`       | `pip list --outdated`   |\n| Node.js   | `npm audit` or `pnpm audit`         | `npm outdated`          |\n| Go        | `govulncheck .\u002F...`                 | `go list -u -m all`     |\n\nInstall the tool if it's missing (e.g. `cargo install cargo-audit`),\nthen run it from the project root with the lockfile present.\n\n### Triage by severity\n\n- **Critical \u002F High** — fix immediately. Update or replace the\n  dependency before merging anything else.\n- **Medium** — schedule a fix within the current sprint.\n- **Low** — track and address when convenient.\n\nFor each finding, check whether a patched version exists, whether the\nvulnerable code path is actually reached, and whether a workaround\n(config, version pin) buys time.\n\n### Update strategy\n\n- Update one dependency at a time so breakage is easy to attribute.\n- Run the full test suite after each update.\n- Read changelogs before any major version bump.\n- Use lockfiles to pin exact versions across environments.\n\n### Ongoing maintenance\n\n- Schedule monthly dependency reviews on the calendar.\n- Enable Dependabot, Renovate, or equivalent for automated update PRs.\n- Document any deliberately pinned versions inline with the reason.\n\n## Gotchas\n\nAgent-specific failure modes — provider-neutral pause-and-self-check items:\n\n- **Running the audit once and never repeating it.** Vulnerabilities are added to advisory databases daily. A clean audit today may have critical findings tomorrow. Schedule monthly audits and integrate the scanner into CI.\n- **Conflating audit with outdated check.** The vulnerability scanner (`cargo audit`, `npm audit`) catches known CVEs in current versions. The outdated checker (`cargo outdated`, `npm outdated`) flags stale packages. They answer different questions and should both run.\n- **Auto-merging Dependabot PRs without running tests.** A Dependabot PR can introduce a breaking API change even in a patch bump. Require CI to pass and spot-check major bumps manually before merging.\n- **Treating \"0 vulnerabilities\" as proof of security.** Known-CVE scans miss typosquatting, abandoned maintainers, license risks, and malicious updates. A clean audit is a necessary condition, not a sufficient one.\n- **Suppressing findings without documenting the reason.** Future auditors cannot tell whether a suppressed advisory was intentional or forgotten. Every ignore rule needs a rationale and an expiry date.\n- **Batching many dependency updates into one PR.** When a multi-update PR breaks something, you cannot attribute the breakage to the specific dependency. Update one dependency at a time, run the tests, then merge.\n- **Treating a major version bump the same as a patch bump.** Major bumps require changelog review for breaking changes before merging. A quick major-bump merge is how silent regressions reach production.\n\n## Full reference\n\n### What \"audit\" actually checks\n\nAudit tools cross-reference the lockfile against vulnerability\ndatabases (RustSec, OSV, GitHub Advisory, npm advisory). They report\ndirect and transitive dependencies, but they only catch known\nvulnerabilities — a clean audit is not the same as a secure\ndependency tree.\n\n### When the fix isn't trivial\n\n- **No patched version exists.** Pin the current version, file an\n  upstream issue, and look for an alternative library. Document the\n  acceptance in the lockfile or a `SECURITY.md` exception list.\n- **Patched version is a major bump.** Branch off, run the upgrade in\n  isolation, and address breaking changes before merging.\n- **Vulnerability is in a transitive dep.** Force-resolve the\n  transitive version (npm `overrides`, pnpm `overrides`, Cargo\n  `[patch]`, pip constraints) until the parent dependency catches up.\n- **The vulnerable code path is unreachable in your usage.** Note the\n  rationale alongside the suppression. Do not silently ignore.\n\n### Anti-patterns\n\n- Running the audit once and never again.\n- Bumping a dozen dependencies in a single PR.\n- Suppressing findings without writing down the reason.\n- Trusting \"0 vulnerabilities\" as proof of security — supply-chain\n  risk extends beyond known CVEs (typosquats, malicious updates,\n  abandoned maintainers).\n- Auto-merging Dependabot PRs without running tests.\n\n### Output expectations\n\nA useful audit summary identifies the package manager, lists each\nvulnerable dependency with its severity and recommended fix, calls\nout anything without a maintained alternative, and proposes a single\nordered update sequence.\n","# Dependency Audit\n\n## Intro\n\nThird-party dependencies are the largest part of most codebases'\nattack surface. A dependency audit runs the ecosystem's vulnerability\nscanner, triages findings by severity, and produces a concrete update\nplan.\n\n## Overview\n\n### Run the right tool\n\nEach ecosystem ships its own audit command:\n\n| Ecosystem | Audit command                       | Outdated check          |\n|-----------|-------------------------------------|-------------------------|\n| Rust      | `cargo audit`                       | `cargo outdated`        |\n| Python    | `pip-audit` or `safety check`       | `pip list --outdated`   |\n| Node.js   | `npm audit` or `pnpm audit`         | `npm outdated`          |\n| Go        | `govulncheck .\u002F...`                 | `go list -u -m all`     |\n\nInstall the tool if it's missing (e.g. `cargo install cargo-audit`),\nthen run it from the project root with the lockfile present.\n\n### Triage by severity\n\n- **Critical \u002F High** — fix immediately. Update or replace the\n  dependency before merging anything else.\n- **Medium** — schedule a fix within the current sprint.\n- **Low** — track and address when convenient.\n\nFor each finding, check whether a patched version exists, whether the\nvulnerable code path is actually reached, and whether a workaround\n(config, version pin) buys time.\n\n### Update strategy\n\n- Update one dependency at a time so breakage is easy to attribute.\n- Run the full test suite after each update.\n- Read changelogs before any major version bump.\n- Use lockfiles to pin exact versions across environments.\n\n### Ongoing maintenance\n\n- Schedule monthly dependency reviews on the calendar.\n- Enable Dependabot, Renovate, or equivalent for automated update PRs.\n- Document any deliberately pinned versions inline with the reason.\n\n## Gotchas\n\nAgent-specific failure modes — provider-neutral pause-and-self-check items:\n\n- **Running the audit once and never repeating it.** Vulnerabilities are added to advisory databases daily. A clean audit today may have critical findings tomorrow. Schedule monthly audits and integrate the scanner into CI.\n- **Conflating audit with outdated check.** The vulnerability scanner (`cargo audit`, `npm audit`) catches known CVEs in current versions. The outdated checker (`cargo outdated`, `npm outdated`) flags stale packages. They answer different questions and should both run.\n- **Auto-merging Dependabot PRs without running tests.** A Dependabot PR can introduce a breaking API change even in a patch bump. Require CI to pass and spot-check major bumps manually before merging.\n- **Treating \"0 vulnerabilities\" as proof of security.** Known-CVE scans miss typosquatting, abandoned maintainers, license risks, and malicious updates. A clean audit is a necessary condition, not a sufficient one.\n- **Suppressing findings without documenting the reason.** Future auditors cannot tell whether a suppressed advisory was intentional or forgotten. Every ignore rule needs a rationale and an expiry date.\n- **Batching many dependency updates into one PR.** When a multi-update PR breaks something, you cannot attribute the breakage to the specific dependency. Update one dependency at a time, run the tests, then merge.\n- **Treating a major version bump the same as a patch bump.** Major bumps require changelog review for breaking changes before merging. A quick major-bump merge is how silent regressions reach production.\n\n## Full reference\n\n### What \"audit\" actually checks\n\nAudit tools cross-reference the lockfile against vulnerability\ndatabases (RustSec, OSV, GitHub Advisory, npm advisory). They report\ndirect and transitive dependencies, but they only catch known\nvulnerabilities — a clean audit is not the same as a secure\ndependency tree.\n\n### When the fix isn't trivial\n\n- **No patched version exists.** Pin the current version, file an\n  upstream issue, and look for an alternative library. Document the\n  acceptance in the lockfile or a `SECURITY.md` exception list.\n- **Patched version is a major bump.** Branch off, run the upgrade in\n  isolation, and address breaking changes before merging.\n- **Vulnerability is in a transitive dep.** Force-resolve the\n  transitive version (npm `overrides`, pnpm `overrides`, Cargo\n  `[patch]`, pip constraints) until the parent dependency catches up.\n- **The vulnerable code path is unreachable in your usage.** Note the\n  rationale alongside the suppression. Do not silently ignore.\n\n### Anti-patterns\n\n- Running the audit once and never again.\n- Bumping a dozen dependencies in a single PR.\n- Suppressing findings without writing down the reason.\n- Trusting \"0 vulnerabilities\" as proof of security — supply-chain\n  risk extends beyond known CVEs (typosquats, malicious updates,\n  abandoned maintainers).\n- Auto-merging Dependabot PRs without running tests.\n\n### Output expectations\n\nA useful audit summary identifies the package manager, lists each\nvulnerable dependency with its severity and recommended fix, calls\nout anything without a maintained alternative, and proposes a single\nordered update sequence.\n",{"name":5,"metadata":44,"description":50},{"processkit":45},{"id":46,"created":47,"version":48,"category":33,"apiVersion":49},"SKILL-dependency-audit",1775433600000,"1.1.0","processkit.projectious.work\u002Fv1","Audit project dependencies for vulnerabilities and outdated packages. Use when checking the security posture of dependencies, planning updates, or running a pre-release dependency review.\n","main","4876a92620ee792aac2ac9a1a806322d8a572367","archive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.18.2\u002Fcontext\u002Fskills\u002Fengineering\u002Fdependency-audit","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit","https:\u002F\u002Fprojectious-work.github.io\u002Fprocesskit\u002F","https:\u002F\u002Fgithub.com\u002Fprojectious-work","2026-11-11 23:24:18",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add projectious-work\u002Fprocesskit --skill dependency-audit",{"tool":64,"command":65},"bunx","bunx skills add projectious-work\u002Fprocesskit --skill dependency-audit",{"tool":67,"command":68},"pnpm","pnpm dlx skills add projectious-work\u002Fprocesskit --skill dependency-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Farchive\u002Fprocesskit-install-20261101\u002Fcontext\u002Ftemplates\u002Fprocesskit\u002Fv0.18.2\u002Fcontext\u002Fskills\u002Fengineering\u002Fdependency-audit\u002FSKILL.md",true,[],[73,99,119,139,156,174],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":84,"publishedAt":39},"01M6X5MTC89B4ZGXW3JVSQCPF8","skill-management","Manage Skill package manifests as v1 ontology entities.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fskill-management\u002FSKILL.md",[79],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[85,86,87,88,89,90,32,91,92,93,75,94,95,96,26,97,98],"management","skill management","create","update","package","alpha","list","manage","ontology","get","as","manifests","skill package","transition",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":106,"publishedAt":39},"01M6X5MCV74NHW5MEDNHZRF2C8","schema-management","Manage generated processkit schema contracts through deterministic MCP rebuild and inspection workflows.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fschema-management\u002FSKILL.md",[105],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},[85,107,108,109,110,111,90,32,112,113,92,114,115,116,94,117,118],"schema","schema management","MCP","workflows","validation","generated","rebuild","contracts","wed","deterministic","contract","mode",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":39},"01M6X5M5G6YJ96AMZGSCZJ1D13","proposition-management","Record claims, risks, beliefs, world facts, WSJF estimates, and assumptions through the Proposition interface.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fproposition-management\u002FSKILL.md",[],[85,126,127,87,88,128,90,32,129,130,131,132,94,133,134,135,27,136,137,138],"proposition","proposition management","index","log","world","record","query","creation","event","interface","facts","claims","WSJF",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M6X5KMQ83QN9M6MPWZM7344F","ontology-management","Manage generated v1 ontology entities that do not require a dedicated domain server.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fontology-management\u002FSKILL.md",[],[85,93,146,87,90,147,148,112,149,129,92,150,151,94,152,153,134,154,26,155],"ontology management","lifecycle","archive","roadmap","do","domain","iteration","keep","measurement","generic",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M6X5KCY2DN3SM21RERSFNEBT","okf-compatibility","Import, export, and validate conformant Open Knowledge Format bundles.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fokf-compatibility\u002FSKILL.md",[],[163,164,165,166,90,167,168,169,32,170,171,172,173],"okf","compatibility","okf compatibility","validate","open","knowledge","format","export","bundles","bundle","import",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":39},"01M6X5JA8S5PNGJVFW4EQY8T83","capability-management","Manage versioned Capability entities and their governed lifecycle.","https:\u002F\u002Fgithub.com\u002Fprojectious-work\u002Fprocesskit\u002Fblob\u002Fmain\u002Fsrc\u002Fcontext\u002Fskills\u002Fprocesskit\u002Fcapability-management\u002FSKILL.md",[],[85,181,182,87,88,128,90,147,32,91,129,183,92,131,94,153,134,135,184,98],"capability","capability management","queries","changes"]