Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →oliver-kriska/deps-vet
Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.
Passed 9 of 17 test cases with the skill, and 2 of 17 without it.
and 7 more in the full report
10 fixed2 passed either way9 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
During single-package vetting of `telemetry` `1.2.1`, the rule scan produces a BLOCK severity finding. When prompting the user for a verdict using AskUserQuestion, which choice must be pre-selected or default-highlighted?
| Checked | Without skill | With skill |
|---|---|---|
| Highlights the Skip option by default when any BLOCK severity finding exists | Missed | Passed |
The instructions your model reads when the skill loads.
Review a Hex package version, run Phase 1 supply-chain rules against it,
prompt the user for a verdict, append the result to hex_vet.exs
(project-root audit ledger). Vetted versions get downgraded to INFO
on subsequent /phx:deps-audit runs.
Run this AFTER /phx:deps-audit to clear findings.
Run this BEFORE merging a mix.lock PR to certify new versions.
/phx:deps-vet phoenix 1.7.21 # vet a single package version
/phx:deps-vet --seed # import curated baseline seed (~30 pkgs)
/phx:deps-vet --list # show existing ledger entries
/phx:deps-vet --check # cross-check mix.lock vs ledger
AskUserQuestion
confirmation. Drive-by trust ruins the ledger's value.mix.lock has version X and the
ledger vets X-1, emit INFO and treat X as unvetted. Don't silently
trust the older entry.hex_vet.exs is a first-class
security artifact, visible in PR review. Don't move it into .claude/.inspect/2. When appending, read the file with
Code.eval_file/1, mutate the map, and write back via
inspect(term, pretty: true, limit: :infinity). Hand-rolled string
appends drift over time.:safe_to_deploy defaults.AskUserQuestion (criteria split, new/overwrite/no-op) MUST be
derived from the loaded data before prompting — e.g.
Enum.frequencies_by(seed.audits, & &1.criteria). Eyeballing the
file and approving on wrong numbers corrupts the consent.test cases passed, vs 2 / 17 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.