Prompt·Testing and security·T04
Risk from outside packages
Checks what a harmful outside package or pull request could reach.
Prompt
Review dependency and CI supply-chain exposure: install scripts, untrusted pull requests, privileged tokens, outdated packages, and unsafe automation permissions.
- What it returns
- Advisories matched to installed versions, install scripts present, workflow permissions and which secrets each job can read.
- Skip it when
- Rarely; run after adding packages or automated build jobs.
- Changes
- Changes nothing
- Sessions
- One session
- Tools
- The lockfile (exact package list), automated build workflow files, npm audit or the auditor skill.
- Also called
- Supply-chain exposure
Related prompts
More in Testing and security.