技能 when-mapping-dependencies-use-dependency-mapper
📦

when-mapping-dependencies-use-dependency-mapper

v1.0.0 内容修订 r1 高风险 🌐 网络访问📁 文件系统访问⚙️ 外部命令⚡ 包含脚本🔑 环境变量

映射项目依赖

大型依赖树可能隐藏安全、版本和架构风险。此技能指导 Claude、Codex 和 Claude Code 完成依赖发现、图分析和报告生成。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "when-mapping-dependencies-use-dependency-mapper" from https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper.md 已签名 manifest GET /api/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/manifest 已签名 lockfile GET /api/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/lockfile

测试它

正在使用“when-mapping-dependencies-use-dependency-mapper”。 在发布前分析一个 Node.js 项目。

预期结果:

  • 检测到 npm，包含一个 manifest 和一个 lock file。
  • 总结直接依赖和传递依赖的规模。
  • 优先列出有漏洞的包，并建议有针对性的更新。

正在使用“when-mapping-dependencies-use-dependency-mapper”。 审查存在构建冲突的服务的依赖架构。

预期结果:

  • 突出显示可能导致运行时不匹配的重复包版本。
  • 标记深层传递链以供维护者审查。
  • 为团队提供依赖图摘要。

正在使用“when-mapping-dependencies-use-dependency-mapper”。 准备一份面向管理层的依赖健康摘要。

预期结果:

  • 总结依赖规模、安全状态、过时包和许可证问题。
  • 区分紧急修复和长期清理任务。
  • 列出审查过程中使用的假设和外部数据源。

安全审计

高风险
v8 • 2026/7/6 打开版本化报告

Most markdown and diagram detections are false positives caused by examples, fenced code blocks, or labels. Confirmed risks include npx Claude-Flow hooks, hidden cache reads, canned audit output, network token use, and unsanitized HTML tooltips. No prompt injection text was found.

7
已扫描文件
2,622
分析行数
8
复核项
0
已忽略误报

已确认安全问题 (7)

高
subagent-dependency-mapper.md:274
Environment file access
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The implementation uses SNYK_TOKEN as a bearer credential in an outbound request. Mishandling that token would expose a sensitive API secret.
高
slash-command-dep-map.sh:243-368
Simulated Dependency Audit Output
The executable wrapper prints fixed npm, dependency, vulnerability, and recommendation results after a simulated flow. This can mislead users into trusting an audit that did not parse the project.
The script echoes fixed package counts, vulnerability counts, and recommendations without reading project manifests during those lines.
高
slash-command-dep-map.sh:138-149slash-command-dep-map.sh:384-396mcp-dependency-mapper.json:285-298
Unpinned npx Coordination Hooks
The skill runs npx claude-flow@alpha hooks when npx exists and defines MCP hook commands for task, memory, and session events. This creates supply-chain and data-sharing side effects outside dependency mapping.
The executable shell wrapper invokes npx hooks directly, and the MCP schema declares hook commands that can store files and export session metrics.
中
slash-command-dep-map.sh:148
System reconnaissance
--session-id "swarm-dependency-mapper" \
The executable wrapper runs a Claude-Flow session-restore hook through npx when available. Restoring shared session state is a real side effect that can expose prior context.
低
slash-command-dep-map.sh:391
System reconnaissance
--task-id "dependency-mapper-$(date +%s)" \
The executable wrapper runs a Claude-Flow post-task hook through npx. It is not classic reconnaissance, but it creates external coordination side effects during analysis.
低
subagent-dependency-mapper.md:32
System reconnaissance
npx claude-flow@alpha hooks session-restore --session-id "swarm-dependency-mapper"
The subagent protocol instructs running a Claude-Flow session-restore hook. It is documentation, but it describes intended behavior that can retrieve shared context.
低
subagent-dependency-mapper.md:205
System reconnaissance
--task-id "dependency-mapper-[timestamp]"
The subagent protocol includes a Claude-Flow post-task hook. The direct risk is limited, but it records task state outside the dependency analysis itself.
能力复核项 (8)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
mcp-dependency-mapper.json:303
Hidden file access
"cache_directory": "$HOME/.claude-cache/dependency-mapper",
The MCP configuration defines a cache under $HOME/.claude-cache, outside the project tree. That can persist project dependency metadata in a hidden user directory.
中
slash-command-dep-map.sh:154
Hidden file access
CACHE_FILE="$HOME/.claude-cache/dependency-mapper/$CACHE_KEY.json"
The executable wrapper reads from $HOME/.claude-cache/dependency-mapper using a project-derived cache key. Hidden cache access can expose or reuse dependency data outside the reviewed repository.
中
subagent-dependency-mapper.md:482
innerHTML assignment (XSS risk)
tooltip.innerHTML = \`
The HTML visualization assigns tooltip.innerHTML using dependency metadata. Malicious package names or versions could inject markup into generated reports.
中
subagent-dependency-mapper.md:272
Fetch API call
const snykResult = await fetch('https://api.snyk.io/v1/test', {
The documented implementation posts package data to the Snyk API. This is legitimate for vulnerability scanning, but it is an outbound network disclosure that needs consent.
中
subagent-dependency-mapper.md:272
Hardcoded URL
const snykResult = await fetch('https://api.snyk.io/v1/test', {
The Snyk API endpoint is hardcoded for outbound vulnerability checks. Package data can leave the local environment when this implementation is used.
中
subagent-dependency-mapper.md:380
Hardcoded URL
<script src="https://d3js.org/d3.v7.min.js"></script>
Generated HTML loads D3 from a public CDN. That introduces third-party script supply-chain and privacy exposure in reports opened by users.
中
subagent-dependency-mapper.md:274
Environment variable access (dot notation)
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The implementation reads process.env.SNYK_TOKEN and places it in an Authorization header. This is expected for Snyk, but it handles a secret that must be protected.
中
subagent-dependency-mapper.md:274
Environment variable object
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The code accesses the process environment to retrieve SNYK_TOKEN. Environment-based secret access is a real risk if logs or reports expose request details.

风险因素

🌐 网络访问 (9)
mcp-dependency-mapper.json:360 mcp-dependency-mapper.json:361 PROCESS.md:91 PROCESS.md:357 README.md:92 slash-command-dep-map.sh:366 subagent-dependency-mapper.md:272 subagent-dependency-mapper.md:272 subagent-dependency-mapper.md:380
📁 文件系统访问 (12)
mcp-dependency-mapper.json:303 process-diagram.gv:53 slash-command-dep-map.sh:154 slash-command-dep-map.sh:138 slash-command-dep-map.sh:145 slash-command-dep-map.sh:149 slash-command-dep-map.sh:153 slash-command-dep-map.sh:158 slash-command-dep-map.sh:163 slash-command-dep-map.sh:385 slash-command-dep-map.sh:392 slash-command-dep-map.sh:396
⚙️ 外部命令 (45)
README.md:192 README.md:201 SKILL.md:72-74 SKILL.md:74-77 SKILL.md:77-79 SKILL.md:79-82 SKILL.md:82-89 SKILL.md:89-124 SKILL.md:124-141 SKILL.md:141-157 SKILL.md:157-159 SKILL.md:159-162 SKILL.md:162-164 SKILL.md:164-167 SKILL.md:167-169 SKILL.md:169-172 SKILL.md:172-174 SKILL.md:174-179 SKILL.md:179-189 SKILL.md:189-194 SKILL.md:194-206 SKILL.md:206-238 slash-command-dep-map.sh:125 slash-command-dep-map.sh:131 slash-command-dep-map.sh:132 slash-command-dep-map.sh:133 slash-command-dep-map.sh:144 slash-command-dep-map.sh:153 slash-command-dep-map.sh:158 slash-command-dep-map.sh:193 slash-command-dep-map.sh:194 slash-command-dep-map.sh:195 slash-command-dep-map.sh:230 slash-command-dep-map.sh:391 subagent-dependency-mapper.md:274-285 subagent-dependency-mapper.md:296-304 subagent-dependency-mapper.md:315-337 subagent-dependency-mapper.md:337-369 subagent-dependency-mapper.md:427 subagent-dependency-mapper.md:482-489 subagent-dependency-mapper.md:517-519 subagent-dependency-mapper.md:526-537 subagent-dependency-mapper.md:537-544 subagent-dependency-mapper.md:544-554 subagent-dependency-mapper.md:623-626
⚡ 包含脚本 (1)
subagent-dependency-mapper.md:482
🔑 环境变量 (2)
subagent-dependency-mapper.md:274 subagent-dependency-mapper.md:274

检测到的模式

System reconnaissance×4
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/security.svg)](https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

Claude Code. (2026). when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8

BibTeX 引用

@techreport{claude-code-dnyoussef-when-mapping-dependencies-use-dependency-mapper-2026, author = {Claude Code}, title = {when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8)" version: "1.0.0" type: report authors: - name: "Claude Code" date-released: "2026-07-06" url: "https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8" identifiers: - type: other value: "skillstore:dnyoussef-when-mapping-dependencies-use-dependency-mapper:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
100
可维护性
87
内容
70
社区
83
规范符合性

你能构建什么

准备发布审计

在发布前审查直接包和传递包，重点关注漏洞和过时依赖。

调查架构循环

映射依赖路径，以发现循环引用、重复包和深层传递链。

创建供应链报告

为利益相关方总结包数量、安全状态、许可证检查和修复任务。

试试这些提示

基础依赖映射 
使用 dependency-mapper 分析此项目。识别包管理器、直接依赖、传递依赖数量和主要风险。
以安全为重点的审计 
对该仓库使用 dependency-mapper 进行安全分析。优先处理 critical 和 high 漏洞、受影响的包以及实际可行的升级步骤。
架构依赖审查 
使用 dependency-mapper 查找循环依赖、重复包、深层依赖链，以及应简化的依赖组。
完整供应链报告 
使用 dependency-mapper 生成完整的依赖风险报告，包括漏洞来源、许可证问题、过时包、图洞察和修复措施。

最佳实践

  • 在敏感仓库上运行 shell wrapper 前先进行审查。
  • 启用第三方漏洞检查前确认网络使用情况。
  • 使用原生包管理器验证生成的建议。

避免

  • 不要将模拟的 console output 视为已完成的审计。
  • 不要在共享日志或生成的报告中暴露 API tokens。
  • 不要在未经清理的情况下发布由不受信任元数据生成的 HTML。

常见问题

此技能描述了哪些包管理器？
它涵盖 npm、yarn、pnpm、pip、poetry、pipenv、cargo、Maven、Gradle、Go modules、bundler、composer 和 NuGet。
它本身会执行真实的漏洞扫描吗？
文档定义了扫描工作流。shell wrapper 主要用于准备说明和模拟输出。
它需要网络访问吗？
从 Snyk、GitHub advisories、CVE sources 或 OSV 等服务获取当前漏洞数据需要网络访问。
它可以生成可视化依赖图吗？
可以。该技能描述了用于依赖树和风险高亮的 HTML、SVG、GraphViz 和 console 可视化。
用户在运行它之前应审查什么？
审查 npx Claude-Flow commands、输出目录、缓存目录和第三方 API token 的使用。
此技能对于敏感项目安全吗？
请谨慎使用。它未被判定为恶意，但外部命令和网络行为需要获得批准。

开发者详情

许可证

MIT

作者版本

v1.0.0

Skillstore 修订

r1

仓库

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/dependencies/when-mapping-dependencies-use-dependency-mapper

引用

72d5025b022c77f7a51bdf5c1637c689c80e89d1

维护新鲜度

2026/7/20

使用量

5 次下载 · 197 次浏览

文件结构

📄 mcp-dependency-mapper.json

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

📄 slash-command-dep-map.sh

📄 subagent-dependency-mapper.md

Claude Code 的更多技能

相关技能

查看全部