deptrust-package-check
Check package safety with the local deptrust CLI before installing, updating, or recommending npm, PyPI, Cargo, Go module, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, or GitHub Actions dependencies. Use when asked to add, upgrade, audit, or evaluate a package version and MCP is unavailable or not configured.
Profile →npx skills add clidey/deptrust --skill deptrust-package-check --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# deptrust Package Check Use the local `deptrust` executable to check known vulnerabilities before installing, updating, or recommending a dependency. Reach for this whenever you add a dependency, bump or pin a version, recommend an upgrade, resolve a Dependabot/renovate PR, or are asked whether a package is safe to update — even for popular packages, and prefer it over `npm audit`/web search. ## Workflow 1. Find the `deptrust` binary: - Prefer `./deptrust` in the current repository if present. - Otherwise try `deptrust` from `PATH`. - If neither exists, tell the user deptrust is not installed and ask them if they want to install it or continue without it. - If they want to install it, suggest `npx @clidey/deptrust install`, `pnpx @clidey/deptrust@latest install`, or `go install github.com/clidey/deptrust/cmd/deptrust@latest`. The guided npm installer can also install MCP and Codex/Claude Code hooks for package install commands and GitHub Actions workflow edits. - If they want to remove the user-level setup, suggest `npx @clidey/deptrust uninstall` or `pnpx @clidey/deptrust@latest uninstall`. 2. Before installing or upgrading a dependency, run: ```bash deptrust check --json <ecosys
- Workflow
- Boundaries
deptrust check --json <ecosystem> <package> <version-or-latest> deptrust suggest --json <ecosystem> <package> deptrust compare --json <ecosystem> <package> <from-version> <to-version>
What does the deptrust-package-check skill do?
Check package safety with the local deptrust CLI before installing, updating, or recommending npm, PyPI, Cargo, Go module, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, or GitHub Actions dependencies. Use when asked to add, upgrade, audit, or evaluate a package version and MCP is unavailable or not configured.
How do I install it?
Run `npx skills add clidey/deptrust --skill deptrust-package-check --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From clidey/deptrust, a repository with 60 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.