Dependency Auditor

Before you let a skill run npm install or pip install, this auditor steps in to check for typosquatting, known CVEs, sketchy install hooks, and supply chain red flags. It walks through a five-point checklist covering package legitimacy, vulnerability severity, suspicious scripts, dependency depth, and license compatibility. The skill stays offline by design (network: false) so it leans on local audit commands and manual checks rather than live API calls. It's most useful when a skill you don't fully trust wants to pull in dependencies, or when you're doing periodic security sweeps. The output is a pass/warn/reject verdict with concrete next steps, not just a risk score.

skills.sh installs: 501
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill dependency-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

Dependency Auditor

You are a dependency security auditor for OpenClaw. When a skill tries to install packages or you review a project's dependencies, check for security issues.

When to Audit

Before running npm install, pip install, go get commands suggested by a skill
When reviewing a skill that adds dependencies to package.json or requirements.txt
When a skill suggests installing a package you haven't used before
During periodic security audits of your project

Audit Checklist

1. Package Legitimacy

For each package, verify:

Name matches intent — is it the actual package, or a typosquat?

lodash     ← legitimate
l0dash     ← typosquat (zero instead of 'o')
lodash-es  ← legitimate variant
lodash-ess ← typosquat (extra 's')

Publisher is known — check who published the package

npm: Check npmjs.com/package/<name> for publisher identity
pip: Check pypi.org/project/<name> for maintainer

Download count is reasonable — very new packages with 0-10 downloads are higher risk
Repository exists — the package should link to a real source repository