GitHub Actions Supply Chain Pinning
asyncapi/generator
A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.
Install Review Dependencies
$ npx skills add tobihagemann/turbo --skill review-dependencies -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install tobihagemann/turbo review-dependencies --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .claude/skills && cp -r skills-src/codex/skills/review-dependencies .claude/skills/review-dependencies && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .claude/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependenciesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add tobihagemann/turbo --skill review-dependencies -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install tobihagemann/turbo review-dependencies --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .agents/skills && cp -r skills-src/codex/skills/review-dependencies .agents/skills/review-dependencies && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .agents/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add tobihagemann/turbo --skill review-dependencies -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install tobihagemann/turbo review-dependencies --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/codex/skills/review-dependencies .cursor/skills/review-dependencies && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .cursor/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/tobihagemann/turbo.git --path codex/skills/review-dependencies--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add tobihagemann/turbo --skill review-dependencies -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install tobihagemann/turbo review-dependencies --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/codex/skills/review-dependencies .gemini/skills/review-dependencies && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .gemini/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install tobihagemann/turbo review-dependenciesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add tobihagemann/turbo --skill review-dependencies -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .github/skills && cp -r skills-src/codex/skills/review-dependencies .github/skills/review-dependencies && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .github/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add tobihagemann/turbo --skill review-dependencies -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install tobihagemann/turbo review-dependencies --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/tobihagemann/turbo.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/codex/skills/review-dependencies .opencode/skills/review-dependencies && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "review-dependencies" agent skill from https://github.com/tobihagemann/turbo/tree/main/codex/skills/review-dependencies into .opencode/skills/review-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "review-dependencies", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
review-dependencies- GitHub stars
- 408
- Token cost
- ~1.5k tokens
- SKILL.md length
- 648 words
- Files
- 1
- Skills in repo
- 81
- Repo updated
- First seen
- Licence
- MIT
At a glance
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.
- Works in 3 steps: Detect Package Managers → Discovery → Report Findings
- The user asks to review dependencies
- SKILL.md covers Step 1: Detect Package Managers, Step 2: Discovery, Step 3: Report Findings and Output Format, plus 1 more section
- Calls gh, npm and yarn
What it does
Review Dependencies is an agent skill from tobihagemann/turbo. Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Returns structured findings without upgrading. Use when the user asks to "review dependencies", "check for outdated packages", "check dependencies", "scan dependencies", "dependency review", "check for outdated GitHub Actions", or "are my workflow actions up to date".
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Vulnerability scanning and CI/CD. It works with GitHub Actions, Gradle, npm and Ruby. The repository describes itself as: Reusable workflows for planning, building, reviewing, and shipping with Claude Code and Codex. The licence is MIT.
When your agent uses it
- The user asks to review dependencies
- Check for outdated packages
- Check dependencies
- Scan dependencies
Example prompts
- “review dependencies”
- “check for outdated packages”
- “check dependencies”
- “/review-dependencies”
Requirements
- Python 3
- Node.js
- Docker
Workflow steps
3 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 931eda5. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
ghnpmyarnpnpmpippoetryuvcargogobundlemvngradle
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use gh, npm, yarn, pnpm, pip and uv, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Review Dependencies loads about 1.5k tokens when it runs. Until then it costs about 96 tokens; SKILL.md has 648 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from tobihagemann/turbo at commit 931eda5, republished under its MIT licence (© tobihagemann). 648 words, ~1,494 tokens.
Download SKILL.mdSave it as
.claude/skills/review-dependencies/SKILL.md (or your agent's skills folder).- name
- review-dependencies
- description
- Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Returns structured findings without upgrading. Use when the user asks to "review dependencies", "check for outdated packages", "check dependencies", "scan dependencies", "dependency review", "check for outdated GitHub Actions", or "are my workflow actions up to date".
Review Dependencies
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Step 1: Detect Package Managers
Identify which package managers are in use by searching for config files:
| Config file | Package manager | Lockfile | Ecosystem |
|---|---|---|---|
package.json | npm / yarn / pnpm | package-lock.json / yarn.lock / pnpm-lock.yaml | Node.js |
Package.swift, *.xcodeproj | Swift Package Manager | Package.resolved | Swift |
pyproject.toml, requirements.txt, setup.py | pip / poetry / uv | poetry.lock, uv.lock | Python |
Cargo.toml | cargo | Cargo.lock | Rust |
go.mod | Go modules | go.sum | Go |
Gemfile | Bundler | Gemfile.lock | Ruby |
pom.xml | Maven | — | Java |
build.gradle, build.gradle.kts | Gradle | gradle.lockfile | Java/Kotlin |
.github/workflows/*.yml / .yaml, action.yml / .yaml | GitHub Actions | — | CI |
Swift dependencies can live in Package.swift or be configured directly in the Xcode project file (.xcodeproj/.xcworkspace). For Xcode-managed dependencies, inspect the project's package references.
Detection steps:
- Search for config files in the project root and subdirectories (exclude vendored directories)
- If a lockfile exists, use the corresponding package manager variant (e.g.,
yarn.lock→ yarn,pnpm-lock.yaml→ pnpm) - When the repo declares a dependency automation config (
.github/dependabot.yml/.yaml,renovate.json,.github/renovate.json), read it and add every ecosystem it declares to the set found by the config-file search - When the repo has a GitHub remote, list open dependency PRs with
gh pr list --author app/dependabot(orapp/renovate), and mark each upgrade one of them already proposes - If multiple instances of the same package manager found (e.g., monorepo with several
package.jsonfiles): userequest_user_inputto let the user pick one (Codexrequest_user_inputchoices are mutually exclusive). For an "all of them" workflow, ask follow-up free-form input or run the review per instance. - If multiple package managers found: use
request_user_inputto let the user pick one. Exclude the CI ecosystem from that choice and review it alongside whichever the user picks - If none found across every step above: inform user and stop
Show full SKILL.md (352 more words)Show less
Step 2: Discovery
Run the appropriate discovery command to find available updates:
| Package manager | Discovery command | Notes |
|---|---|---|
| npm | ncu --format group | Requires npm-check-updates. Suggest npm install -g npm-check-updates if missing. |
| yarn | ncu --format group or yarn upgrade-interactive | |
| pnpm | ncu --format group or pnpm outdated | |
| Swift PM | Check resolved versions in Package.resolved against latest releases via web search | No built-in outdated command. Read Package.swift or inspect the Xcode project to identify dependencies and their current version constraints. |
| pip | pip list --outdated | |
| poetry | poetry show --outdated | |
| uv | uv pip list --outdated | |
| cargo | cargo outdated | Requires cargo-outdated. Fall back to comparing Cargo.toml versions via web search. |
| Go modules | go list -m -u all | |
| Bundler | bundle outdated | |
| Maven | mvn versions:display-dependency-updates | |
| Gradle | gradle dependencyUpdates | Requires com.github.ben-manes.versions plugin. |
| GitHub Actions | gh api repos/<owner>/<repo>/releases/latest --jq .tag_name, compared against each uses: ref | No outdated command. Take <owner>/<repo> from the ref's first two path segments. Read a SHA-pinned ref's version from its trailing comment (uses: <owner>/<action>@<sha> # v1.2.3). Compare only the components the ref pins, so @v7 is current against v7.0.1. Fall back to repos/<owner>/<repo>/tags when the release 404s or its tag namespace differs from the ref's, and to web search when the action is not hosted on GitHub. Exclude local (./…), <repo-relative> ($/…), and Docker (docker://…) refs, which pin no release. |
Categorize updates:
- Major (breaking changes) — requires migration research
- Minor (new features, backward compatible)
- Patch (bug fixes)
Step 3: Report Findings
If the discovery tool is not installed, suggest the installation command (see Step 2 notes column). If no tool exists for the ecosystem, fall back to manual version checking via web search.
If no updates are available, report that dependencies are up to date. Otherwise, report each update in the output format below, followed by the Overall Verdict.
Then call update_plan to mark this step completed and continue with the next step of the active workflow.
Output Format
Format each finding as:
### [P<N>] <title (imperative, <=80 chars)>
**Package:** `<name>` <current> -> <latest>
**Manager:** <npm/pip/cargo/etc.>
**Proposed:** <open automation PR already covering this upgrade, when one exists>
<one paragraph: why this matters, known vulnerabilities if any, major version gap>After all findings, add:
## Overall Verdict
**Dependencies:** <up to date | updates available>
<summary with counts: N major, N minor, N patch>Priority Levels
- P0 — Known security vulnerability (CVE) in the current version
- P1 — Multiple major versions behind (e.g., React 17 → 19)
- P2 — One major version behind or significantly outdated minor versions
- P3 — Minor or patch updates available
© tobihagemann, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in codex/skills/review-dependencies of tobihagemann/turbo.
Open the folder on GitHubat commit 931eda5
Compare with similar skills
Review Dependencies next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Review Dependencies this skilltobihagemann/turbo | 408 | — | ~1.5k | Automated safety check: Pass | MIT | |
| GitHub Actions Supply Chain Pinningasyncapi/generator | 1.1k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | |
| Linea Dependency MaintenanceConsensys-Incorporated/linea-attestation-registry | 177 | 1 repos | ~3.7k | Automated safety check: Warn | MIT | |
| Dsh Web UI Releaseningbainb/deepseek-harness-desktop | 789 | — | ~1.4k | Automated safety check: Warn | BSD-3-Clause | |
| ReleaseWebMCP-org/npm-packages | 104 | — | ~1.6k | Automated safety check: Notes | MIT | |
| Upgrade Notesgetknit/knit | 133 | — | ~1.2k | Automated safety check: Pass | GPL-3.0 |
Similar skills
Linea Dependency Maintenance
Consensys-Incorporated/linea-attestation-registry
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…
Dsh Web UI Release
ningbainb/deepseek-harness-desktop
Release and publish the dsh-web-ui monorepo (DSH Web GUI plugin family + skin collection) — bump all packages to one unified version, commit and tag, push the vX.Y.Z tag that triggers the GitHub…
Release
WebMCP-org/npm-packages
Release the @mcp-b monorepo with Changesets and pnpm, using npm trusted publishing in GitHub Actions.
Upgrade Notes
getknit/knit
Read the vendor's breaking changes, deprecations, migration notes and CVEs for every version between the one pinned now and the one being moved to, through the whatsnew MCP server's upgradenotes tool.
npm Release Via GitHub Actions
jmfederico/pi-web
A skill your agent uses whenever the user asks for a new npm version, npm release, package release, new release, version bump, publishing to npm, cutting a GitHub release, tagging a release, or…
More from tobihagemann/turbo
All 81 skills in this repoConsult Oracle
tobihagemann/turbo
Consult ChatGPT Pro via ChatGPT browser automation for problems that resist standard approaches.
Fetch PR Comments
tobihagemann/turbo
Fetch and summarize review feedback and conversation from a GitHub PR (unresolved review threads, review bodies, and PR conversation comments) without making changes.
Recall Rationale
tobihagemann/turbo
Recall why a past change was made by locating the Claude Code transcript that produced it.
Resolve PR Comments
tobihagemann/turbo
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments.
Resolve PR Comments
tobihagemann/turbo
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments.
Assess Technical Debt
tobihagemann/turbo
Assess project-wide structural technical debt: complexity hotspots, deprecated API usage, duplication clusters, architecture rot, and low-value tests.
Related
Categories
Questions about Review Dependencies
What does Review Dependencies do?
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Review Dependencies is an agent skill from tobihagemann/turbo. Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.
When should I use Review Dependencies?
Review Dependencies fits situations like: the user asks to review dependencies; check for outdated packages; check dependencies; scan dependencies.
How do I install Review Dependencies in Claude Code?
Run `npx skills add tobihagemann/turbo --skill review-dependencies -a claude-code`. Or copy the skill folder (codex/skills/review-dependencies in tobihagemann/turbo) into .claude/skills/review-dependencies in your project. Claude Code loads it when a task matches its description.
How do I install Review Dependencies in Codex?
Run `npx skills add tobihagemann/turbo --skill review-dependencies -a codex`. Or copy the skill folder (codex/skills/review-dependencies in tobihagemann/turbo) into .agents/skills/review-dependencies in your project. Codex loads it when a task matches its description.
Can I use Review Dependencies in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add tobihagemann/turbo --skill review-dependencies -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/review-dependencies, .gemini/skills/review-dependencies, .github/skills/review-dependencies and .opencode/skills/review-dependencies in your project.
What does Review Dependencies need to run?
Going by SKILL.md and its folder, Review Dependencies needs the command-line tools its instructions call (gh, npm, yarn, pnpm, pip and poetry). Our summary lists: Python 3; Node.js; Docker.
Does Review Dependencies access the network?
SKILL.md contains no URLs. Its commands use gh, npm, pip and uv, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Review Dependencies safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Review Dependencies use?
Review Dependencies is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Review Dependencies use?
About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Review Dependencies?
Skills that share tags, products or a category with Review Dependencies: GitHub Actions Supply Chain Pinning (asyncapi/generator, 1.1k stars), Linea Dependency Maintenance (Consensys-Incorporated/linea-attestation-registry, 177 stars), Dsh Web UI Release (ningbainb/deepseek-harness-desktop, 789 stars) and Release (WebMCP-org/npm-packages, 104 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Review Dependencies?
tobihagemann (a GitHub user) maintains it in tobihagemann/turbo, which has 408 GitHub stars. The repository holds 81 skills in this directory. The repository was last updated on October 9, 2026.
Source: tobihagemann/turbo on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.