# Risk from outside packages

Prompt · Testing and security · T04

Checks what a harmful outside package or pull request could reach.

## Prompt

```text
Review dependency and CI supply-chain exposure: install scripts, untrusted pull requests, privileged tokens, outdated packages, and unsafe automation permissions.
```

**What it returns:** Advisories matched to installed versions, install scripts present, workflow permissions and which secrets each job can read.

**Skip it when:** Rarely; run after adding packages or automated build jobs.

**Tools:** The lockfile (exact package list), automated build workflow files, npm audit or the auditor skill.

**Changes:** Changes nothing

**Sessions:** One session

## Related

- [Packages nobody uses, or that work by luck](https://www.atlasscope.dev/prompts/packages-nobody-uses-or-that-work-by-luck): Finds packages nobody uses and packages that work only by accident.
- [Check time that catches nothing](https://www.atlasscope.dev/prompts/check-time-that-catches-nothing): Finds paid automated-check minutes spent on checks that never catch anything.

Source: https://www.atlasscope.dev/prompts/risk-from-outside-packages