New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Triage Dependencies

by seqra in seqra/opentaint

Mark which of a project's dependency libraries could introduce taint sources.

Apache-2.0Auto-check passedSecurity

Install Triage Dependencies

skills CLI
$ npx skills add seqra/opentaint --skill triage-dependencies -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seqra/opentaint triage-dependencies --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/triage-dependencies .claude/skills/triage-dependencies && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
triage-dependencies
GitHub stars
162
Token cost
~733 tokens
SKILL.md length
386 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Mark which of a project's dependency libraries could introduce taint sources.

  • Works in 4 steps: List the dependencies → Mark each library → Write the flag list → …
  • Start source discovery
  • SKILL.md covers Inputs, Workflow, Output and Tracking
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Triage Dependencies is an agent skill from seqra/opentaint. Mark which of a project's dependency libraries could introduce taint sources. Use to start source discovery

Its SKILL.md is about 730 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

  • Start source discovery
  • Tasks that involve Static analysis and SAST

Example prompts

  • “/triage-dependencies”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. List the dependencies
  2. Mark each library
  3. Write the flag list
  4. Verify before returning

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Triage Dependencies loads about 733 tokens when it runs. Until then it costs about 32 tokens; SKILL.md has 386 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~32
When it runs · the whole SKILL.md, loaded when a task matches
~733

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 386 words, ~733 tokens.

Download SKILL.mdSave it as .claude/skills/triage-dependencies/SKILL.md (or your agent's skills folder).
name
triage-dependencies
description
Mark which of a project's dependency libraries could introduce taint sources. Use to start source discovery
license
Apache-2.0
metadata.author
opentaint
metadata.version
0.3.0

Skill: Triage Dependencies

Read the project's dependency libraries and flag the ones that can introduce a taint source — a place untrusted data enters

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory

Workflow

1. List the dependencies

Read .opentaint/project/project.yaml — the dependencies list under each per-language projects entry is every third-party dependency the model resolved. Resolve each to the library it is. Most of a large project's dependencies are transitive infrastructure

2. Mark each library

For each library decide: could it introduce an attacker-controlled source — a method returning untrusted data (HTTP/RPC request data, message-broker payloads, deserialized untrusted input and so on)? Judge by the library's identity itself, read sources to get overviews, docs

3. Write the flag list

Write in .opentaint/tracking/coverage.yaml (per Tracking) a flat list of the flagged libraries' packages

When coverage.yaml already exists from a prior run, reconcile rather than overwrite: keep every listed package and add any dependency newly added to the model that could introduce a source. A flagged package whose usage shifted (new call sites, a version bump) needs no re-open — source discovery automatically plans any used member not yet verdicted. When unsure whether a package belongs, list it: an over-flag only costs one discovery pass, a missed library loses its sources on every later stage

Show full SKILL.md (131 more words)Show less
4. Verify before returning

Re-check the full dependency list against your flags: confirm every dependency was judged, then re-read the ones you did NOT flag and make sure none of them can actually introduce a source. A library left out here loses its sources on every later stage and the run can't recover it. Add any package you missed to the list. This is a re-read of what you already wrote — simple grep or re-read is fine, no need to use some scripts.

Output

Short and concise report of what was done

Artifacts:
  • .opentaint/tracking/coverage.yaml — the flagged packages list
Summary:
  • one line per flagged package: the package and why it was flagged

Tracking

.opentaint/tracking/coverage.yaml — a flat list of the dependency packages flagged to drill for taint sources. Keep it clear from comments

yaml
packages:
  - <dependency-package-a>
  - <dependency-package-b>

© seqra, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/triage-dependencies of seqra/opentaint.

Open the folder on GitHubat commit f945f92

Compare with similar skills

Triage Dependencies next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Triage Dependencies compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Triage Dependencies this skillseqra/opentaint162—~733Automated safety check: PassApache-2.0
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner286—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    286 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Triage Codeql

    netdata/netdata

    Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

    81k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

More from seqra/opentaint

All 16 skills in this repo

  • Analyze External Methods

    seqra/opentaint

    Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks.

    162 GitHub stars~3.2k tokensUpdated yesterday
    Auto-check passed

  • Create Dataflow Approximation

    seqra/opentaint

    Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes.

    162 GitHub stars~1.9k tokensUpdated yesterday
    Auto-check passed

  • Orchestrate Stage

    seqra/opentaint

    Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

    162 GitHub stars~806 tokensUpdated yesterday
    Auto-check passed

  • Appsec Agent

    seqra/opentaint

    Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

    162 GitHub stars~2.2k tokensUpdated yesterday
    Auto-check passed

  • Build Project

    seqra/opentaint

    Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

    162 GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Create Pass Through Approximation

    seqra/opentaint

    Model a method's taint propagation as a passThrough approximation.

    162 GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Triage Dependencies

What does Triage Dependencies do?

Mark which of a project's dependency libraries could introduce taint sources. Triage Dependencies is an agent skill from seqra/opentaint. Mark which of a project's dependency libraries could introduce taint sources.

When should I use Triage Dependencies?

Triage Dependencies fits situations like: start source discovery; tasks that involve Static analysis and SAST.

How do I install Triage Dependencies in Claude Code?

Run `npx skills add seqra/opentaint --skill triage-dependencies -a claude-code`. Or copy the skill folder (skills/triage-dependencies in seqra/opentaint) into .claude/skills/triage-dependencies in your project. Claude Code loads it when a task matches its description.

How do I install Triage Dependencies in Codex?

Run `npx skills add seqra/opentaint --skill triage-dependencies -a codex`. Or copy the skill folder (skills/triage-dependencies in seqra/opentaint) into .agents/skills/triage-dependencies in your project. Codex loads it when a task matches its description.

Can I use Triage Dependencies in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill triage-dependencies -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage-dependencies, .gemini/skills/triage-dependencies, .github/skills/triage-dependencies and .opencode/skills/triage-dependencies in your project.

What does Triage Dependencies need to run?

SKILL.md names no scripts, command-line tools or credentials: Triage Dependencies is instructions for the agent only.

Does Triage Dependencies access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Triage Dependencies safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Triage Dependencies use?

Triage Dependencies is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Triage Dependencies use?

About 733 tokens (SKILL.md is roughly 2.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Triage Dependencies?

Skills that share tags, products or a category with Triage Dependencies: Semgrep (vigolium/piolium, 140 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Triage Dependencies?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.