Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →athola/dependency-verification
Verifies a package exists before install, defending against hallucination and slopsquatting.
Passed 19 of 21 test cases with the skill, and 13 of 21 without it.
and 5 more in the full report
7 fixed13 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our CI runner operates in an isolated offline environment without external internet access. Which environment variable allows the package hallucination guard hook to perform offline typosquat checking without making network requests?
| Checked | Without skill | With skill |
|---|---|---|
| The response sets IMBUE_PKG_REGISTRY_CHECK to 0. | Missed | Passed |
The instructions your model reads when the skill loads.
A package name the model produced is a claim, not a fact. The registry is the fact. Verify before you install.
Code-generating language models recommend packages that do not
exist at a measured rate of 5.2% (commercial models) to 21.7%
(open models) across 576,000 samples (Spracklen et al. 2024,
arXiv 2406.10279). Worse, 58% of hallucinated names recur across
reruns, so an attacker can predict them, register the empty name,
and ship malware. This is "slopsquatting." A proof-of-concept
package (huggingface-cli) drew over 30,000 downloads after being
registered against a commonly hallucinated name. Package
hallucination is also inversely correlated with coding-benchmark
score, so a better model does not make this go away.
The defense is cheap: confirm the name exists in its registry
before installing or recommending it. This skill defines that
check and is enforced by the guard_package_hallucination.py
PreToolUse hook.
Apply before any of these:
pip install, uv add, npm install, pnpm add,
yarn add, cargo add, poetry add, or pdm add.pyproject.toml, requirements.txt,
package.json, or Cargo.toml.sanctum:version-updates)leyline:supply-chain-advisory)test cases passed, vs 13 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.