Installs into .claude/skills of the current project.
Are you the author of Dependency Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/andersseen-dependency-security)
---
name: dependency-security
description: Vet, pin and update third-party dependencies deliberately.
---
# Dependency security
Most code shipped in a modern application is code nobody on the team wrote. Treat adding a dependency
as a security decision.
## Vet before adding
Check maintenance activity, release history, install footprint and transitive dependency count. A
small utility that pulls in dozens of packages costs more than writing the function yourself.
## Pin and lock
Commit the lockfile and keep ranges narrow for anything security relevant. Reproducible installs are
what let you tell whether a change came from your code or from a dependency.
## Update on a schedule, not in panic
Apply security patches promptly and take routine updates in small regular batches. Large infrequent
upgrades are where breakage accumulates and where an urgent patch gets stuck behind unrelated
changes.
## Audit in CI
Fail the build on known critical vulnerabilities in the dependency tree. Review each advisory for
exploitability in your context before treating it as urgent.
## Beware install-time execution
Post-install scripts run with your permissions on developer machines and in CI. Disable them where
the toolchain allows, and know what remains enabled.
