Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →secondsky/sap-dependency-security
SAP dependency security and MCP executable trust policy with secure upgrades, cooldowns, staged rollout, and supply-chain protection.
Passed 19 of 21 test cases with the skill, and 6 of 21 without it.
and 18 more in the full report
14 fixed6 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are upgrading to pnpm 10.x and want to prevent malicious package versions from overriding installed build artifacts or downgrading locked packages. What configuration setting in pnpm-workspace.yaml prevents dependency downgrades?
| Checked | Without skill | With skill |
|---|---|---|
| Enables trustPolicy: no-downgrade in pnpm workspace configuration. | Missed | Passed |
The instructions your model reads when the skill loads.
Manage SAP dependency security and upgrades with supply chain protection, compatibility analysis, staged rollout, and comprehensive testing across all major package managers.
.mcp.json| Issue | Recommended response |
|---|---|
Floating MCP package or @latest in .mcp.json | Replace with an exact version or approved source commit and run npm run validate:mcp-security. |
| Lockfile changed unexpectedly | Review package manager config, block lifecycle scripts, and regenerate only after dependency intent is clear. |
| Dependency is too new for cooldown policy | Hold the upgrade unless a documented security exception justifies immediate adoption. |
| Tenant-connected tool changed source | Verify the source URL, commit, and build steps before using credentials. |
Interactive — Walk through setup questions to generate tailored config. Use for fresh setup.
Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization optional.
test cases passed, vs 6 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.