Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
Usar antes de aceptar una dependencia nueva. An agent skill from 686f6c61/alfred-dev.
Install Evaluate Dependency
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install 686f6c61/alfred-dev evaluate-dependency --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/evaluate-dependency .claude/skills/evaluate-dependency && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .claude/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependencyType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install 686f6c61/alfred-dev evaluate-dependency --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/evaluate-dependency .agents/skills/evaluate-dependency && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .agents/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install 686f6c61/alfred-dev evaluate-dependency --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/evaluate-dependency .cursor/skills/evaluate-dependency && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .cursor/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/686f6c61/alfred-dev.git --path skills/evaluate-dependency--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install 686f6c61/alfred-dev evaluate-dependency --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/evaluate-dependency .gemini/skills/evaluate-dependency && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .gemini/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install 686f6c61/alfred-dev evaluate-dependencyInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/evaluate-dependency .github/skills/evaluate-dependency && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .github/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install 686f6c61/alfred-dev evaluate-dependency --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/686f6c61/alfred-dev.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/evaluate-dependency .opencode/skills/evaluate-dependency && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "evaluate-dependency" agent skill from https://github.com/686f6c61/alfred-dev/tree/main/skills/evaluate-dependency into .opencode/skills/evaluate-dependency/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evaluate-dependency", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
evaluate-dependency- GitHub stars
- 117
- Token cost
- ~379 tokens
- SKILL.md length
- 187 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- MIT
At a glance
Usar antes de aceptar una dependencia nueva. An agent skill from 686f6c61/alfred-dev.
- Works in 5 steps: Confirma que el paquete no está ya en el… → Recoge datos verificables (lockfile,… → Veredicto: APROBAR, RECHAZAR o APROBAR… → …
- Tasks that involve Vulnerability scanning
- SKILL.md covers Resumen, Proceso, Criterios de éxito and Qué NO hacer
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Evaluate Dependency is an agent skill from 686f6c61/alfred-dev. Usar antes de aceptar una dependencia nueva. También: auditar paquete, licencia, CVEs, transitivas, bundle, npm install, pip, cargo add.
Its SKILL.md is about 380 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Vulnerability scanning. It works with npm. The repository describes itself as: Tu equipo de desarrolladores en un plugin. 10 agentes, 11 skills planas, 18 comandos /alfred-dev:. Memoria persistente, quality gates con evidencia y MCP local. The licence is MIT.
When your agent uses it
- Tasks that involve Vulnerability scanning
Example prompts
- “/evaluate-dependency”
Requirements
- Node.js
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Confirma que el paquete no está ya en el registro.
- Recoge datos verificables (lockfile, registro, advisory)
- Veredicto: APROBAR, RECHAZAR o APROBAR CON CONDICIONES.
- Añade o actualiza una fila en docs/project/dependencies.md. Si el
- Si el veredicto no es APROBAR, no la instales. Propón alternativa.
What it can do on your machine
Read from SKILL.md and the folder at commit be0b51e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Evaluate Dependency loads about 379 tokens when it runs. Until then it costs about 39 tokens; SKILL.md has 187 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from 686f6c61/alfred-dev at commit be0b51e, republished under its MIT licence (© 686f6c61). 187 words, ~379 tokens.
Download SKILL.mdSave it as
.claude/skills/evaluate-dependency/SKILL.md (or your agent's skills folder).- name
- evaluate-dependency
- description
- Usar antes de aceptar una dependencia nueva. También: auditar paquete, licencia, CVEs, transitivas, bundle, npm install, pip, cargo add.
Evaluar una dependencia
Resumen
Antes de añadir un paquete, evalúalo y deja el veredicto en
docs/project/dependencies.md. El helper puede crear el esqueleto; tú
escribes la fila.
Proceso
Confirma que el paquete no está ya en el registro.
Recoge datos verificables (lockfile, registro, advisory):
- nombre y versión exacta
- peso aproximado o impacto en el bundle
- último release y mantenimiento
- licencia y compatibilidad con el proyecto
- CVEs conocidos o «ninguno encontrado» (con fuente)
- número de transitivas
- alternativa más ligera o nativa
Veredicto:
APROBAR,RECHAZARoAPROBAR CON CONDICIONES.Añade o actualiza una fila en
docs/project/dependencies.md. Si el fichero era esqueleto y ya hay una evaluación real, sustituye<!-- alfred-doc:scaffold -->por<!-- alfred-doc:filled -->.Si el veredicto no es
APROBAR, no la instales. Propón alternativa.
Criterios de éxito
- La fila existe con versión, licencia y veredicto.
- Un CVE «no aplica» lleva una frase técnica, no un supuesto.
- El registro vive en el repo, no solo en el chat.
Qué NO hacer
- No evalues de memoria sin mirar el lockfile o el manifiesto.
- No apruebes una dependencia para «ya la usamos todos» sin dato.
- No dejes licencias como desconocidas sin decirlo.
© 686f6c61, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/evaluate-dependency of 686f6c61/alfred-dev.
Open the folder on GitHubat commit be0b51e
Compare with similar skills
Evaluate Dependency next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Evaluate Dependency this skill686f6c61/alfred-dev | 117 | — | ~379 | Automated safety check: Pass | MIT | |
| Security AuditTheDecipherist/claude-code-mastery | 550 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Pre-Commit Security Scanzereight/gitlab-mcp | 2k | 1 repos | ~859 | Automated safety check: Notes | MIT | |
| Dependency Auditbriiirussell/cybersecurity-skills | 413 | — | ~3.2k | Automated safety check: Warn | MIT | |
| Dependency Checkruvnet/ruflo | 74k | — | ~258 | Automated safety check: Pass | MIT | |
| Scanning For Vulnerabilitiesjeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~927 | Automated safety check: Pass | MIT |
Similar skills
Pre-Commit Security Scan
zereight/gitlab-mcp
Runs a fast security sweep of recent code changes before a commit or PR, checking for leaked secrets, vulnerable dependencies, unsafe input handling and auth gaps.
Dependency Audit
briiirussell/cybersecurity-skills
Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns.
Dependency Check
ruvnet/ruflo
Scan project dependencies for known vulnerabilities and CVEs.
Scanning For Vulnerabilities
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables comprehensive vulnerability scanning using the vulnerability-scanner plugin.
Tencentos Expert
infometa/workbuddyskills
TencentOS Server 全栈运维诊断，根据用户的自然语言描述，自动识别需要的能力接口，查询能力实现，使用具体能力解决客户问题。覆盖磁盘空间/分区/文件系统/LVM/健康检测、网络连通性/丢包/延迟排查、CPU火焰图/系统调用热点/调度延迟/中断均衡/文件IO延迟/进程IO追踪分析、内存泄漏/OOM诊断、系统日志/服务管理/时间同步/软件包/软件源管理、kdump配置与故障排查、等保三级…
More from 686f6c61/alfred-dev
All 11 skills in this repoIncident Response
686f6c61/alfred-dev
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem.
Memory
686f6c61/alfred-dev
This skill should be used when the user asks to record a design decision, search past project decisions, inspect the Alfred memory timeline, or work with the alfred-memory MCP server.
PR Workflow
686f6c61/alfred-dev
Crear pull requests completas con descripcion, labels y reviewers
Sonarqube
686f6c61/alfred-dev
Levantar SonarQube con Docker, analizar el código y proponer mejoras.
Style Direction
686f6c61/alfred-dev
Abrir y operar el companion visual de Selina para elegir una direccion de estilo en proyectos con interfaz.
Sync Project Docs
686f6c61/alfred-dev
Usar para sincronizar la documentación viva del proyecto después de una fase.
Related
Works with
Categories
Questions about Evaluate Dependency
What does Evaluate Dependency do?
Usar antes de aceptar una dependencia nueva. An agent skill from 686f6c61/alfred-dev. Evaluate Dependency is an agent skill from 686f6c61/alfred-dev. Usar antes de aceptar una dependencia nueva.
When should I use Evaluate Dependency?
Evaluate Dependency fits situations like: tasks that involve Vulnerability scanning.
How do I install Evaluate Dependency in Claude Code?
Run `npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a claude-code`. Or copy the skill folder (skills/evaluate-dependency in 686f6c61/alfred-dev) into .claude/skills/evaluate-dependency in your project. Claude Code loads it when a task matches its description.
How do I install Evaluate Dependency in Codex?
Run `npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a codex`. Or copy the skill folder (skills/evaluate-dependency in 686f6c61/alfred-dev) into .agents/skills/evaluate-dependency in your project. Codex loads it when a task matches its description.
Can I use Evaluate Dependency in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add 686f6c61/alfred-dev --skill evaluate-dependency -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/evaluate-dependency, .gemini/skills/evaluate-dependency, .github/skills/evaluate-dependency and .opencode/skills/evaluate-dependency in your project.
What does Evaluate Dependency need to run?
SKILL.md names no scripts, command-line tools or credentials: Evaluate Dependency is instructions for the agent only. Our summary lists: Node.js.
Does Evaluate Dependency access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Evaluate Dependency safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Evaluate Dependency use?
Evaluate Dependency is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Evaluate Dependency use?
About 379 tokens (SKILL.md is roughly 1.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Evaluate Dependency?
Skills that share tags, products or a category with Evaluate Dependency: Security Audit (TheDecipherist/claude-code-mastery, 550 stars), Pre-Commit Security Scan (zereight/gitlab-mcp, 2k stars), Dependency Audit (briiirussell/cybersecurity-skills, 413 stars) and Dependency Check (ruvnet/ruflo, 74k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Evaluate Dependency?
686f6c61 (a GitHub user) maintains it in 686f6c61/alfred-dev, which has 117 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on August 15, 2026.
Source: 686f6c61/alfred-dev on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.