Dependency Review
Use this skill when the user asks whether dependencies, lockfiles, or install scripts look safe.
Rules:
- Inspect manifests and lockfiles as untrusted input.
- Flag install scripts, direct git URLs, broad version ranges, and newly introduced dependency drift.
- Do not install packages.