deps-audit
Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.
npx skills add oliver-kriska/claude-elixir-phoenix --skill deps-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Hex Dependency Audit Non-mutating supply-chain audit for Hex packages. Runs an 8-rule MVP catalogue against changed packages, enriches with Hex API metadata, wraps existing tools (`mix hex.audit`, `mix_audit`, OSV-Scanner), and emits a triage table. ## When to Use - After `mix deps.update` or `mix deps.get` brought in new versions - On PRs that touch `mix.lock` (pre-merge gate) - Before manually updating a single package (`--preview <pkg>`) - When investigating a dependency you don't recognize ## Iron Laws 1. **NEVER claim a diff is clean without inspecting it.** Run all 8 rules on the unpacked NEW tarball. "Looks fine" without a tool run is a false pass. **Always write `.claude/deps-audit/last-run.json`** — its absence is evidence the audit didn't actually run. 2. **NEVER install `mix_audit` / `osv-scanner` — even if asked.** Detect, warn with install instructions, skip cleanly if missing. If the user says "install it," respond with the install command (e.g., `mix deps.add mix_audit --only dev`) and **do not execute it**. The audit skill is non-mutating; `mix.exs` / `mix.lock` are off-limits regardless of consent. 3. **NEVER promote a finding to BLOCK without rule citation.** Ev
- When to Use
- Iron Laws
- Operating Modes
- Execution Flow
- Step 1: Resolve the diff
- Step 2: Fetch tarballs (per-run tmpdir)
- Step 3: Run the 8 MVP rules on each NEW tarball
- Step 4: External tool wrappers (parallel)
- Step 5: Hex API enrichment (per package)
- Step 5.5: Apply hexvet.exs ledger (if present)
- Step 5.7: Differential subtract
- Step 5.8: LLM triage (when score > threshold)
- Step 6: Score & render
- Out of scope / Phase 3 surface
What does the deps-audit skill do?
Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.
How do I install it?
Run `npx skills add oliver-kriska/claude-elixir-phoenix --skill deps-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From oliver-kriska/claude-elixir-phoenix, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.