# Dependency Security

> Managing Supply Chain Security, SBOM generation, and vulnerability patching (SCA).

- Skill: `majiayu000/dependency-security-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/dependency-security-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/dependency-security-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/dependency-security-2

---


# dependency-security Skill

This skill secures the software supply chain.

## 1. Software Composition Analysis (SCA)
> "You are what you import."

- **Audit**: Run `npm audit` / `pip-audit` / `cargo audit` in CI.
- **Block**: Fail the build on `CRITICAL` or `HIGH` vulnerabilities.
- **Lock**: Always verify lockfiles (`package-lock.json`) match `package.json`.

## 2. SBOM (Software Bill of Materials)
- Generate a list of all ingredients in your software.
- Tools: `syft`, `cyclonedx-cli`.
- Why? Rapid response when the next Log4Shell happens.

## 3. Dependency Pinning
- **Pin Exact Versions**: Avoid `^1.2.3` in critical apps. Use `1.2.3` to prevent "works on my machine" drift.
- **Private Registry**: For enterprise, proxy public registries to prevent "Left-Pad" incidents.

## 4. Typosquatting Defense
- **Scope**: Use `@myorg/package` scopes.
- **Verify**: Check download counts and maintainer reputation before adding new deps.