deps-vet
Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.
npx skills add oliver-kriska/claude-elixir-phoenix --skill deps-vet --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Deps Vet — Hex package audit ledger Review a Hex package version, run Phase 1 supply-chain rules against it, prompt the user for a verdict, append the result to `hex_vet.exs` (project-root audit ledger). Vetted versions get downgraded to `INFO` on subsequent `/phx:deps-audit` runs. Run this AFTER `/phx:deps-audit` to clear findings. Run this BEFORE merging a `mix.lock` PR to certify new versions. ## Usage ```text /phx:deps-vet phoenix 1.7.21 # vet a single package version /phx:deps-vet --seed # import curated baseline seed (~30 pkgs) /phx:deps-vet --list # show existing ledger entries /phx:deps-vet --check # cross-check mix.lock vs ledger ``` ## Iron Laws 1. **NEVER auto-approve.** Every entry MUST come from an `AskUserQuestion` confirmation. Drive-by trust ruins the ledger's value. 2. **Lock wins on disagreement.** If `mix.lock` has version X and the ledger vets X-1, emit INFO and treat X as unvetted. Don't silently trust the older entry. 3. **Ledger lives at project root.** `hex_vet.exs` is a first-class security artifact, visible in PR review. Don't move it into `.claude/`. 4. **Round-trip via `inspect/2`.** When appending, read the file with `Code.eval_file/1`, mutate the map
- Usage
- Iron Laws
- Execution flow
- Step 1: Locate or seed hexvet.exs
- Step 2: Branch by mode
- Step 3: Fetch the tarball (single-vet)
- Step 4: Run Phase 1 rules
- Step 5: Present findings
- Step 6: Prompt for verdict
- Step 7: Append to ledger
- Integration
- References
- Out of scope (Phase 3+)
What does the deps-vet skill do?
Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.
How do I install it?
Run `npx skills add oliver-kriska/claude-elixir-phoenix --skill deps-vet --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From oliver-kriska/claude-elixir-phoenix, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.