dependency-audit-stinger

dependency-audit-stinger is a Secrets & supply chain skill for AI agents, published by legioncodeinc in the that-git-life repository on GitHub. Skillspace rates dependency-audit-stinger C (78/100) and it passed the safety scan; the rating is based on static analysis only.

npm supply-chain hygiene specialist for the @deeplake/hivemind package. Owns npm dependency update tooling (Renovate vs Dependabot for this repo), package-lock.json lockfile discipline (npm ci, minimumReleaseAge), npm audit triage (noise vs real, direct vs transitive), the optionalDependencies + tree-sitter native ABI risk (ensure-tree-sitter postinstall), SBOM generation for the npm package (Syft / CycloneDX), npm provenance (npm publish --provenance / Sigstore), socket.dev behavioral scanning, and the publish-time guards (files allowlist, pack-check.mjs, audit-openclaw, CodeQL). Use when the user says "audit our dependencies", "set up Renovate", "Renovate vs Dependabot", "socket.dev", "generate an SBOM", "npm audit is noisy", "lockfile hygiene", "npm provenance", "tree-sitter postinstall failing", "is our publish safe", or when dependency-audit-worker-bee is invoked. Do NOT use for application-code vulnerability remediation (security-worker-bee), Docker image scanning pipeline…

Grade

C

Quality

78 / 100

Safety

Passed

GitHub stars

72

Unproven: rated by static analysis only, not yet compared head-to-head.

Not launch-quality. It is graded C with a clean safety verdict, but our quality filters exclude it: a model that read it found it written only for the repository it lives in. So it is not in our launch-quality set, the skills our MCP server searches and recommends. How launch-quality is decided

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.