RuView CLI, API and WASM
ruvnet/RuView
Covers the RuView `wifi-densepose` command line binary, its Axum REST API and the WebAssembly builds for browsers and ESP32, for embedding or scripting RuView.
CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use.
Apache-2.0Auto-check passed
Install Scan Dependencies
$ npx skills add whitphx/stlite --skill scan-dependencies -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install whitphx/stlite scan-dependencies --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/scan-dependencies .claude/skills/scan-dependencies && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .claude/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependenciesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add whitphx/stlite --skill scan-dependencies -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install whitphx/stlite scan-dependencies --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/scan-dependencies .agents/skills/scan-dependencies && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .agents/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add whitphx/stlite --skill scan-dependencies -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install whitphx/stlite scan-dependencies --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/scan-dependencies .cursor/skills/scan-dependencies && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .cursor/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/whitphx/stlite.git --path .claude/skills/scan-dependencies--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add whitphx/stlite --skill scan-dependencies -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install whitphx/stlite scan-dependencies --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/scan-dependencies .gemini/skills/scan-dependencies && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .gemini/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install whitphx/stlite scan-dependenciesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add whitphx/stlite --skill scan-dependencies -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/scan-dependencies .github/skills/scan-dependencies && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .github/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add whitphx/stlite --skill scan-dependencies -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install whitphx/stlite scan-dependencies --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/whitphx/stlite.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/scan-dependencies .opencode/skills/scan-dependencies && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "scan-dependencies" agent skill from https://github.com/whitphx/stlite/tree/main/.claude/skills/scan-dependencies into .opencode/skills/scan-dependencies/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan-dependencies", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
scan-dependencies- GitHub stars
- 1.7k
- Token cost
- ~1.7k tokens
- SKILL.md length
- 574 words
- Files
- 1
- Skills in repo
- 4
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use.
- Works in 4 steps: Construct the JSON Payload → Execute the Live Lookup → Decide an Action per Dependency → …
- SKILL.md covers Description, Inputs and Execution Protocol
- Calls jq and curl; reaches api.deps.dev
What it does
Scan Dependencies is an agent skill from whitphx/stlite. CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use. It MUST be called BEFORE any new package is imported or added to dependencies. It can also be used to check whether any new or existing dependencies are unsafe.
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It works with WebAssembly. The repository describes itself as: Streamlit-Lite; In-browser Streamlit 🎈🚀. The licence is Apache-2.0.
Example prompts
- “/scan-dependencies”
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 9a44ae8. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
jqcurl
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
api.deps.dev
Also links to:
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Scan Dependencies loads about 1.7k tokens when it runs. Until then it costs about 66 tokens; SKILL.md has 574 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from whitphx/stlite at commit 9a44ae8, republished under its Apache-2.0 licence (© whitphx). 574 words, ~1,727 tokens.
Download SKILL.mdSave it as
.claude/skills/scan-dependencies/SKILL.md (or your agent's skills folder).- name
- scan-dependencies
- description
- CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use. It MUST be called BEFORE any new package is imported or added to dependencies. It can also be used to check whether any new or existing dependencies are unsafe.
Skill: Evaluate Dependency Security via deps.dev Findings API
Adapted from the deps.dev example skill (Apache License 2.0), with a complete lookup script and an explicit finding-to-action policy based on the v3alpha API definition.
Description
This skill automates the process of auditing package dependencies before adoption. By querying the Open Source Insights (deps.dev) API, it checks a batch of package versions for active security findings (advisories and vulnerabilities) and outputs a clear action plan (ALLOW, CAUTION, or BLOCK).
Inputs
An array of target dependencies. Each dependency must contain:
system: The ecosystem name. Must be uppercase:NPM,PYPI,MAVEN,GO,CARGO,NUGET, orRUBYGEMS.name: The canonical name of the package (e.g.,org.apache.logging.log4j:log4j-corefor Maven, or normalized lowercase for PyPI/NuGet).version: The explicit version string to audit. This may be unset.
Only set the version field if you know the exact version of the package.
This field should not be set if only a version range is known (for example,
^1.0.0 is not acceptable).
Execution Protocol
Step 1: Construct the JSON Payload
Map the incoming dependency list into a single JSON batch request object.
Ensure all items are nested inside the "requests" array under a
"versionKey" or "packageKey" parameter.
Payload Schema Example:
{
"requests": [
{
"versionKey": {
"system": "NPM",
"name": "express",
"version": "4.17.1"
}
},
{
"packageKey": {
"system": "PYPI",
"name": "requests"
}
}
]
}Step 2: Execute the Live Lookup
Write the payload built in Step 1 from the actual input list (not the example
above) to a file, then POST it. Follow nextPageToken until it is absent so the
result set is complete. -f makes HTTP errors fail the command instead of
returning an error body.
echo "Scanning dependencies for safety..."
# deps-request.json holds the Step 1 payload, e.g. built with jq:
# jq -n '{requests: [{versionKey: {system: "NPM", name: "express", version: "4.17.1"}}]}' > deps-request.json
rm -f deps-findings-*.json
page_token=""
page=0
while :; do
page=$((page + 1))
jq --arg t "$page_token" 'if $t == "" then . else . + {pageToken: $t} end' \
deps-request.json > "deps-request-page.json" || exit 1
curl -fsS -X POST https://api.deps.dev/v3alpha/findingsbatch \
-H 'Content-Type: application/json' \
--data-binary @deps-request-page.json \
-o "deps-findings-$page.json" || { echo "Lookup failed: unknown risk"; exit 1; }
jq -e . "deps-findings-$page.json" > /dev/null || { echo "Invalid JSON: unknown risk"; exit 1; }
page_token="$(jq -r '.nextPageToken // ""' "deps-findings-$page.json")"
[ -z "$page_token" ] && break
done
jq -s '[.[].responses[]?]' deps-findings-*.json > deps-findings.jsonIf the request fails, returns invalid JSON, or pagination cannot be completed,
the scan result is unknown risk for every dependency in the batch. Report
that to the user before proceeding; do not treat it as ALLOW.
Show full SKILL.md (284 more words)Show less
Step 3: Decide an Action per Dependency
Match each input dependency to its entry in responses[] (the request field
echoes the request as sent, before canonicalization). A dependency with no matching response,
or a response without findings, is unknown risk and gets CAUTION.
Collect the findings that apply to it:
findings.packageFindings[](package-scoped; apply to every version).- For a
versionKeyrequest:findings.requestedVersion.findings[]. - For a
packageKeyrequest:findings.defaultVersion.findings[](the version that would be installed without an explicit version).
Each finding has a type and a risk. Choose the most severe action:
| Action | When |
|---|---|
BLOCK | Any finding with type: MALICIOUS, or any finding with risk: RISK_CRITICAL. |
CAUTION | Any other finding whose type is not REMEDIATION (e.g. VULNERABLE, DEPRECATED, LOW_USAGE, COOLDOWN, NOT_FOUND, or an unrecognized type), whatever its risk; any REMEDIATION finding with risk: RISK_HIGH, RISK_MEDIUM, or an unrecognized risk (including RISK_UNSPECIFIED); or missing/incomplete results. |
ALLOW | No findings at all, or only REMEDIATION findings with risk: RISK_LOW or RISK_INFORMATIONAL. |
Notes:
COOLDOWNmeans the version is newer than the deps.dev cooldown. Pick an older version or wait; never bypass the project's own cooldowns (package manager age gates, Dependabot cooldowns) to adopt it.findings.recommendedVersions[]lists lower-risk versions; suggest one when the result isBLOCKorCAUTION.
Step 4: Report
Output one line per dependency with its action and the findings (type, risk,
and any deprecatedContext.reason or lowUsageContext.alternativePackages)
that drove it. Do not proceed on BLOCK; surface CAUTION to the user before
proceeding.
Note that just because a dependency doesn't show up in this list, that doesn't mean we are 100% sure that it is safe. CRITICAL: Treat unflagged dependencies as having unknown risk levels. You must state clearly that the scanner only detects known issues and cannot guarantee absolute security.
© whitphx, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .claude/skills/scan-dependencies of whitphx/stlite.
Open the folder on GitHubat commit 9a44ae8
Compare with similar skills
Scan Dependencies next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Scan Dependencies this skillwhitphx/stlite | 1.7k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| RuView CLI, API and WASMruvnet/RuView | 97k | — | ~1.2k | Automated safety check: Notes | MIT | |
| Nginx To Higress Migrationhigress-group/higress | 9.5k | — | ~3.9k | Automated safety check: Pass | Apache-2.0 | |
| Update V86felixrieseberg/windows95 | 24k | — | ~1.7k | Automated safety check: Pass | Custom licence | |
| Dotlottie WebLottieFiles/dotlottie-web | 892 | — | ~3.5k | Automated safety check: Pass | MIT | |
| Adding Internal API RouteTriliumNext/Trilium | 38k | — | ~3.3k | Automated safety check: Pass | AGPL-3.0 |
Similar skills
Nginx To Higress Migration
higress-group/higress
Migrate from ingress-nginx to Higress in Kubernetes environments.
Update V86
felixrieseberg/windows95
Build and install v86 (wasm + libv86.js + BIOS) into windows95.
Dotlottie Web
LottieFiles/dotlottie-web
Implement Lottie animations using dotLottie runtimes (@lottiefiles/dotlottie-web and @lottiefiles/dotlottie-react).
Adding Internal API Route
TriliumNext/Trilium
A skill your agent uses when adding, moving, or wiring an internal REST endpoint in Trilium (a new /api/ route) — choosing between a core-shared handler (packages/trilium-core/src/routes/index.ts…
Client Request Signature Reversal
awarexone/Agentic-Bug-Hunter
Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.
More from whitphx/stlite
Changeset
whitphx/stlite
Create or update a changeset fragment (.changeset/.md) reflecting the changes made in the current session or branch.
Streamlit Rebase
whitphx/stlite
Rebase our custom fork of the Streamlit repository onto new upstream Streamlit release
Copy Samples
whitphx/stlite
Update sharing-editor sample apps from the streamlit/docs repository
Related
Works with
Questions about Scan Dependencies
What does Scan Dependencies do?
CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use. Scan Dependencies is an agent skill from whitphx/stlite. CRITICAL: The scan-dependencies skill flags any dependencies that are unsafe to use.
How do I install Scan Dependencies in Claude Code?
Run `npx skills add whitphx/stlite --skill scan-dependencies -a claude-code`. Or copy the skill folder (.claude/skills/scan-dependencies in whitphx/stlite) into .claude/skills/scan-dependencies in your project. Claude Code loads it when a task matches its description.
How do I install Scan Dependencies in Codex?
Run `npx skills add whitphx/stlite --skill scan-dependencies -a codex`. Or copy the skill folder (.claude/skills/scan-dependencies in whitphx/stlite) into .agents/skills/scan-dependencies in your project. Codex loads it when a task matches its description.
Can I use Scan Dependencies in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add whitphx/stlite --skill scan-dependencies -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/scan-dependencies, .gemini/skills/scan-dependencies, .github/skills/scan-dependencies and .opencode/skills/scan-dependencies in your project.
What does Scan Dependencies need to run?
Going by SKILL.md and its folder, Scan Dependencies needs the command-line tools its instructions call (jq and curl).
Does Scan Dependencies access the network?
SKILL.md names 2 domains. In commands or code: api.deps.dev; the agent is likely to contact it when it follows the instructions. As links in the text: github.com. This is read from the text; nothing was executed.
Is Scan Dependencies safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Scan Dependencies use?
Scan Dependencies is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Scan Dependencies use?
About 1.7k tokens (SKILL.md is roughly 6.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Scan Dependencies?
Skills that share tags, products or a category with Scan Dependencies: RuView CLI, API and WASM (ruvnet/RuView, 97k stars), Nginx To Higress Migration (higress-group/higress, 9.5k stars), Update V86 (felixrieseberg/windows95, 24k stars) and Dotlottie Web (LottieFiles/dotlottie-web, 892 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Scan Dependencies?
whitphx (a GitHub user) maintains it in whitphx/stlite, which has 1,669 GitHub stars. The repository holds 4 skills in this directory. The repository was last updated on October 7, 2026.
Source: whitphx/stlite on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.