Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Dependency Security Audit · bilal140202 | DecimalAI

bilal140202/Oolab-labs__claude-ide-bridge

SkillScore91Maintained

Copy this template to your Claude Desktop scheduled-tasks directory:

agent-toolingby bilal140202

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/bilal140202-oolab-labs-claude-ide-bridge/SKILL.md

decimalai skills pull bilal140202-oolab-labs-claude-ide-bridge --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/bilal140202-oolab-labs-claude-ide-bridge/SKILL.md https://app.decimal.ai/s/bilal140202-oolab-labs-claude-ide-bridge/SKILL.md

Raw file: /s/bilal140202-oolab-labs-claude-ide-bridge/SKILL.md ↗ · machine-readable summary at /s/bilal140202-oolab-labs-claude-ide-bridge.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 51d ago

—-11% tokens0% turns91% of whole cases pass with skill (20/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	-16%	0%
case-05	✗→✓	▲ Improved	-10%	0%
case-07	✗→✓	▲ Improved	-6%	0%
case-08	✗→✓	▲ Improved	-2%	0%
case-09	✗→✓	▲ Improved	-12%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

bilal140202 / the-lord-of-the-skills

skills/mordor/claude-code/Oolab-labs__claude-ide-bridge/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Installation

Copy this template to your Claude Desktop scheduled-tasks directory:

bash
mkdir -p ~/.claude/scheduled-tasks/dependency-audit
cp /path/to/claude-ide-bridge/templates/scheduled-tasks/dependency-audit/SKILL.md \
   ~/.claude/scheduled-tasks/dependency-audit/SKILL.md

Then restart Claude Desktop to detect the new scheduled task. Configure the schedule in Claude Desktop settings under "Scheduled Tasks".

> The bridge must be running when this task fires. Start it with claude-ide-bridge --watch or npm run start-all.

> Emergency stop: Set CLAUDE_CODE_DISABLE_CRON=1 in your environment to immediately halt all scheduled cron jobs mid-session. Useful if a task runs amok or you need to suppress scheduled runs temporarily.

name: dependency-audit description: Scan dependencies for security vulnerabilities and outdated packages. Run weekly via Claude Desktop scheduled tasks.

Dependency Security Audit

Scan all project dependencies for known security vulnerabilities.

Steps

Call getProjectInfo to detect the project type and package manager
Call getSecurityAdvisories to check for known CVEs in dependencies
Call auditDependencies to run the package manager's native audit (npm audit, cargo audit, pip-audit, etc.)
Call getDependencyTree to understand the full dependency graph for any flagged packages

Report Format

# Dependency Audit — <date>

## Package Manager: <npm|cargo|pip|go>

## Vulnerabilities Found: <N total>

### Critical (N)
<package@version — CVE-XXXX-XXXXX — description>
  Fix: upgrade to <version> | No fix available

### High (N)
<package@version — CVE-XXXX-XXXXX — description>
  Fix: upgrade to <version> | No fix available

### Moderate (N)
<package@version — description>

## Outdated Packages
<package — current → latest>  (only packages ≥1 major version OR ≥3 minor versions behind)
Direct: listed in package.json. Transitive: pulled in by direct dependencies.

## Recommended Actions
1. <specific upgrade command or action>
2. <specific upgrade command or action>

## Overall: SECURE | REVIEW NEEDED | ACTION REQUIRED

Grading Criteria

SECURE — 0 vulnerabilities + ≤2 patch-level outdated packages
REVIEW NEEDED — 1-2 moderate advisories OR ≥3 outdated packages
ACTION REQUIRED — any critical/high vulnerability

Guidelines

Focus on actionable findings — skip informational-only advisories
Report only packages ≥1 major version OR ≥3 minor versions behind as "outdated"
Direct dependencies: listed in package.json. Transitive: pulled in by direct dependencies. Flag transitive dependencies separately.
For each vulnerability, include the fix command if one exists (e.g., npm install package@version)
If no vulnerabilities found, report "All clear — 0 vulnerabilities across N dependencies"

Illustrative Want to see what bilal140202/Oolab-labs__claude-ide-bridge would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/8/2026, 17:23 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+50%

91% vs 41%

Agent turns

0%

1.0 vs 1.0

Tokens

-11%

1,300.24 vs 1,464.71

fail → pass · 11pass → pass · 9fail → fail · 2

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Could you run a security audit on all packages in my project? Inspect our project dependencies for known security flaws and outdated versions. I want a structured report featuring the package manager used, identified vulnerabilities organized by severity level, significantly outdated packages, specific remediation steps, and an overall security status rating.	fail→fail	7,946	13,855	+74%	1	1	0%	1,542	1,307	-15%	0	0	—
case-02 Please perform a complete dependency vulnerability check on this repository. I'd like a report that identifies our project's package manager, lists any CVE advisories categorized by critical, high, and moderate severities, highlights outdated direct and transitive dependencies, provides actionable upgrade commands, and gives a final overall rating.	fail→fail	8,181	3,460	-58%	1	1	0%	1,578	991	-37%	0	0	—
case-03 I need an audit report on our project dependencies to check for security advisories and version freshness. Please generate a detailed document including the package manager, vulnerability findings grouped by severity, outdated packages, concrete recommended actions to fix issues, and an overall security classification.	fail→pass	19,947	13,497	-32%	1	1	0%	3,625	3,050	-16%	0	0	—
case-04 When evaluating node package versions for our dependency report, package express is currently at version 3.2.0 while latest is 4.0.0. Should this package be listed in the outdated packages section of the audit report?	pass→pass	7,214	3,220	-55%	1	1	0%	1,307	1,248	-5%	0	0	—
case-05 In an audit of python packages, request-lib is at version 2.1.0 while latest is 2.3.0. A standard npm/pip outdated check usually flags any minor bump. Should this package be included in our audit report's outdated packages section?	fail→pass	9,360	4,433	-53%	1	1	0%	1,596	1,441	-10%	0	0	—
case-06 During a cargo dependency check, serde is at version 1.0.100 while latest is 1.3.0 (3 minor versions ahead). Should this package be reported as outdated?	pass→pass	8,262	4,025	-51%	1	1	0%	1,504	1,427	-5%	0	0	—
case-07 An audit found 0 security vulnerabilities and 2 patch-level outdated packages (e.g. 1.0.1 to 1.0.3). How should the overall security status be rated?	fail→pass	16,124	2,509	-84%	1	1	0%	1,153	1,082	-6%	0	0	—
case-08 An audit discovered 1 moderate severity advisory and 0 critical or high vulnerabilities in an npm project. What overall rating applies to this result?	fail→pass	6,879	2,357	-66%	1	1	0%	1,105	1,085	-2%	0	0	—
case-09 An audit found 0 vulnerabilities but 4 direct dependencies that are 2 major versions out of date. What overall rating should be assigned?	fail→pass	9,585	3,661	-62%	1	1	0%	1,465	1,286	-12%	0	0	—
case-10 An audit revealed 0 critical vulnerabilities, 1 high severity advisory, and 0 outdated packages. What overall status rating must be given?	pass→pass	5,439	1,857	-66%	1	1	0%	795	1,013	+27%	0	0	—
case-11 An audit revealed 1 critical severity CVE in a transitive dependency, but no high or moderate issues. What overall status rating applies?	fail→pass	8,224	2,056	-75%	1	1	0%	1,235	1,019	-17%	0	0	—
case-12 If a project audit finds zero CVE advisories across 150 installed dependencies, what specific text summary should be written under the vulnerability section?	pass→pass	8,213	2,496	-70%	1	1	0%	1,255	1,103	-12%	0	0	—
case-13 A high vulnerability is found in the lodash package at version 4.17.11, with a fix available in 4.17.21. How should the fix be specified under the vulnerability entry?	fail→pass	9,518	3,183	-67%	1	1	0%	1,849	1,330	-28%	0	0	—
case-14 An audit tool flags an informational advisory regarding code style recommendations in a secondary package. Should this finding be listed in the audit report?	pass→pass	9,396	2,719	-71%	1	1	0%	1,501	1,129	-25%	0	0	—
case-15 If a scheduled background audit job starts looping endlessly during a desktop session, what environment variable can be exported to immediately halt all cron operations?	fail→pass	6,825	2,159	-68%	1	1	0%	1,202	1,005	-16%	0	0	—
case-16 Where should task configuration markdown files be placed within the user's home directory for Claude Desktop scheduled task execution?	fail→pass	7,822	2,036	-74%	1	1	0%	1,482	1,080	-27%	0	0	—
case-17 When listing an outdated sub-dependency that was pulled in by a top-level framework package, how should it be distinguished from packages declared directly in package.json?	pass→pass	10,990	4,943	-55%	1	1	0%	1,824	1,599	-12%	0	0	—
case-18 What is the initial diagnostic function or tool call that should be executed to begin inspecting an uncharacterized codebase for security auditing?	pass→pass	11,137	4,516	-59%	1	1	0%	1,869	1,076	-42%	0	0	—
case-19 After identifying that a repository uses cargo and rust, what function call checks for published vulnerability advisories before running local package audits?	fail→pass	7,189	2,579	-64%	1	1	0%	1,229	1,154	-6%	0	0	—
case-20 Please review my JavaScript source code files for unused variables, missing semicolons, and syntax errors using ESLint rules.	fail→pass	2,612	5,396	+107%	1	1	0%	443	1,619	+265%	0	0	—
case-21 We need an open-source license compliance audit on our repository to list all GPL, MIT, and Apache licenses across our third-party dependencies.	pass→pass	11,143	4,171	-63%	1	1	0%	1,956	1,391	-29%	0	0	—
case-22 Can you scan my Dockerfile and container base image for root user usage, unpinned apt installs, and misconfigured permissions?	pass→pass	4,219	3,336	-21%	1	1	0%	786	1,177	+50%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +50 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 40.9%
Pass rate with the skill: 90.9%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/8/2026, 17:23 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

I need an audit report on our project dependencies to check for security advisories and version freshness. Please generate a detailed document including the package manager, vulnerability findings grouped by severity, outdated packages, concrete recommended actions to fix issues, and an overall security classification.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run91

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-13% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 50 days ago

Other measured skills in the registry, with their headline benchmark lift.