技能 when-mapping-dependencies-use-dependency-mapper
📦
when-mapping-dependencies-use-dependency-mapper
v1.0.0 內容修訂 r1 高風險 🌐 網路存取📁 檔案系統存取⚙️ 外部命令⚡ 包含腳本🔑 環境變數
對應專案依賴項
大型依賴樹可能隱藏安全性、版本與架構風險。此技能會引導 Claude、Codex 和 Claude Code 進行依賴項探索、圖形分析與報告。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "when-mapping-dependencies-use-dependency-mapper" from https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「when-mapping-dependencies-use-dependency-mapper」。 在發布前分析 Node.js 專案。
預期結果:
- 偵測到 npm，包含一個 manifest 和一個 lock file。
- 摘要直接與遞移依賴項的數量。
- 排定易受攻擊套件的優先順序，並建議有針對性的更新。
正在使用「when-mapping-dependencies-use-dependency-mapper」。 檢閱存在建置衝突服務的依賴項架構。
預期結果:
- 突顯可能造成執行階段不相符的重複套件版本。
- 標記深層遞移鏈以供維護者檢閱。
- 為團隊提供依賴關係圖摘要。
正在使用「when-mapping-dependencies-use-dependency-mapper」。 準備高階主管依賴項健康狀態摘要。
預期結果:
- 摘要依賴項數量、安全狀態、過時套件與授權疑慮。
- 將緊急修復與長期清理任務分開。
- 列出檢閱期間使用的假設與外部資料來源。
安全審計
高風險v8 • 2026/7/6 開啟版本化報告
Most markdown and diagram detections are false positives caused by examples, fenced code blocks, or labels. Confirmed risks include npx Claude-Flow hooks, hidden cache reads, canned audit output, network token use, and unsanitized HTML tooltips. No prompt injection text was found.
7
已掃描檔案
2,622
分析行數
8
複核項目
0
已忽略的誤報
已確認的安全問題 (7)
高
Environment file access
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The implementation uses SNYK_TOKEN as a bearer credential in an outbound request. Mishandling that token would expose a sensitive API secret.
高
Simulated Dependency Audit Output
The executable wrapper prints fixed npm, dependency, vulnerability, and recommendation results after a simulated flow. This can mislead users into trusting an audit that did not parse the project.
The script echoes fixed package counts, vulnerability counts, and recommendations without reading project manifests during those lines.
高
Unpinned npx Coordination Hooks
The skill runs npx claude-flow@alpha hooks when npx exists and defines MCP hook commands for task, memory, and session events. This creates supply-chain and data-sharing side effects outside dependency mapping.
The executable shell wrapper invokes npx hooks directly, and the MCP schema declares hook commands that can store files and export session metrics.
中
System reconnaissance
--session-id "swarm-dependency-mapper" \
The executable wrapper runs a Claude-Flow session-restore hook through npx when available. Restoring shared session state is a real side effect that can expose prior context.
低
System reconnaissance
--task-id "dependency-mapper-$(date +%s)" \
The executable wrapper runs a Claude-Flow post-task hook through npx. It is not classic reconnaissance, but it creates external coordination side effects during analysis.
低
System reconnaissance
npx claude-flow@alpha hooks session-restore --session-id "swarm-dependency-mapper"
The subagent protocol instructs running a Claude-Flow session-restore hook. It is documentation, but it describes intended behavior that can retrieve shared context.
低
System reconnaissance
--task-id "dependency-mapper-[timestamp]"
The subagent protocol includes a Claude-Flow post-task hook. The direct risk is limited, but it records task state outside the dependency analysis itself.
能力複核項目 (8)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Hidden file access
"cache_directory": "$HOME/.claude-cache/dependency-mapper",
The MCP configuration defines a cache under $HOME/.claude-cache, outside the project tree. That can persist project dependency metadata in a hidden user directory.
中
Hidden file access
CACHE_FILE="$HOME/.claude-cache/dependency-mapper/$CACHE_KEY.json"
The executable wrapper reads from $HOME/.claude-cache/dependency-mapper using a project-derived cache key. Hidden cache access can expose or reuse dependency data outside the reviewed repository.
中
innerHTML assignment (XSS risk)
tooltip.innerHTML = \`
The HTML visualization assigns tooltip.innerHTML using dependency metadata. Malicious package names or versions could inject markup into generated reports.
中
Fetch API call
const snykResult = await fetch('https://api.snyk.io/v1/test', {
The documented implementation posts package data to the Snyk API. This is legitimate for vulnerability scanning, but it is an outbound network disclosure that needs consent.
中
Hardcoded URL
const snykResult = await fetch('https://api.snyk.io/v1/test', {
The Snyk API endpoint is hardcoded for outbound vulnerability checks. Package data can leave the local environment when this implementation is used.
中
Hardcoded URL
<script src="https://d3js.org/d3.v7.min.js"></script>
Generated HTML loads D3 from a public CDN. That introduces third-party script supply-chain and privacy exposure in reports opened by users.
中
Environment variable access (dot notation)
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The implementation reads process.env.SNYK_TOKEN and places it in an Authorization header. This is expected for Snyk, but it handles a secret that must be protected.
中
Environment variable object
headers: { 'Authorization': `token ${process.env.SNYK_TOKEN}` },
The code accesses the process environment to retrieve SNYK_TOKEN. Environment-based secret access is a real risk if logs or reports expose request details.
風險因素
🌐 網路存取 (9)
📁 檔案系統存取 (12)
mcp-dependency-mapper.json:303 process-diagram.gv:53 slash-command-dep-map.sh:154 slash-command-dep-map.sh:138 slash-command-dep-map.sh:145 slash-command-dep-map.sh:149 slash-command-dep-map.sh:153 slash-command-dep-map.sh:158 slash-command-dep-map.sh:163 slash-command-dep-map.sh:385 slash-command-dep-map.sh:392 slash-command-dep-map.sh:396
⚙️ 外部命令 (45)
README.md:192 README.md:201 SKILL.md:72-74 SKILL.md:74-77 SKILL.md:77-79 SKILL.md:79-82 SKILL.md:82-89 SKILL.md:89-124 SKILL.md:124-141 SKILL.md:141-157 SKILL.md:157-159 SKILL.md:159-162 SKILL.md:162-164 SKILL.md:164-167 SKILL.md:167-169 SKILL.md:169-172 SKILL.md:172-174 SKILL.md:174-179 SKILL.md:179-189 SKILL.md:189-194 SKILL.md:194-206 SKILL.md:206-238 slash-command-dep-map.sh:125 slash-command-dep-map.sh:131 slash-command-dep-map.sh:132 slash-command-dep-map.sh:133 slash-command-dep-map.sh:144 slash-command-dep-map.sh:153 slash-command-dep-map.sh:158 slash-command-dep-map.sh:193 slash-command-dep-map.sh:194 slash-command-dep-map.sh:195 slash-command-dep-map.sh:230 slash-command-dep-map.sh:391 subagent-dependency-mapper.md:274-285 subagent-dependency-mapper.md:296-304 subagent-dependency-mapper.md:315-337 subagent-dependency-mapper.md:337-369 subagent-dependency-mapper.md:427 subagent-dependency-mapper.md:482-489 subagent-dependency-mapper.md:517-519 subagent-dependency-mapper.md:526-537 subagent-dependency-mapper.md:537-544 subagent-dependency-mapper.md:544-554 subagent-dependency-mapper.md:623-626
⚡ 包含腳本 (1)
偵測到的模式
System reconnaissance×4
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
Claude Code. (2026). when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8BibTeX 引用
@techreport{claude-code-dnyoussef-when-mapping-dependencies-use-dependency-mapper-2026,
author = {Claude Code},
title = {when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-mapping-dependencies-use-dependency-mapper security audit report (audit version 8)"
version: "1.0.0"
type: report
authors:
- name: "Claude Code"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/dnyoussef-when-mapping-dependencies-use-dependency-mapper/audits/8"
identifiers:
- type: other
value: "skillstore:dnyoussef-when-mapping-dependencies-use-dependency-mapper:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
100
可維護性
87
內容
70
社群
83
規範符合度
你可以打造什麼
準備發布稽核
在發布前檢閱直接與遞移套件，重點關注漏洞與過時依賴項。
調查架構循環
對應依賴路徑，以找出循環引用、重複套件與深層遞移鏈。
建立供應鏈報告
為利害關係人摘要套件數量、安全狀態、授權檢查與修復任務。
試試這些提示
基本依賴項對應
使用 dependency-mapper 分析此專案。識別套件管理器、直接依賴項、遞移依賴項數量，以及主要風險。
以安全性為重點的稽核
使用 dependency-mapper 對此儲存庫進行安全性分析。優先處理嚴重與高風險漏洞、受影響套件，以及實用的升級步驟。
架構依賴項檢閱
使用 dependency-mapper 找出循環依賴、重複套件、深層依賴鏈，以及應簡化的依賴項群組。
完整供應鏈報告
使用 dependency-mapper 產生完整的依賴項風險報告，包含漏洞來源、授權疑慮、過時套件、圖形洞察與修復方案。
最佳實務
- 在敏感儲存庫上執行 shell wrapper 前，先檢閱其內容。
- 啟用第三方漏洞檢查前，確認網路使用情況。
- 使用原生套件管理器驗證產生的建議。
避免
- 不要將模擬的 console 輸出視為已完成的稽核。
- 不要在共用記錄或產生的報告中暴露 API tokens。
- 不要在未清理的情況下發布由不受信任中繼資料產生的 HTML。
常見問題
此技能描述哪些套件管理器？
它涵蓋 npm、yarn、pnpm、pip、poetry、pipenv、cargo、Maven、Gradle、Go modules、bundler、composer 和 NuGet。
它本身會執行真實的漏洞掃描嗎？
文件定義了掃描工作流程。shell wrapper 主要準備指令與模擬輸出。
它需要網路存取嗎？
需要網路存取，才能從 Snyk、GitHub advisories、CVE sources 或 OSV 等服務取得最新漏洞資料。
它可以產生視覺化依賴關係圖嗎？
可以。此技能描述用於依賴樹與風險重點的 HTML、SVG、GraphViz 和 console 視覺化。
使用者在執行前應該檢閱什麼？
檢閱 npx Claude-Flow 命令、輸出目錄、快取目錄，以及第三方 API token 使用情況。
此技能對敏感專案安全嗎？
請謹慎使用。它未被判定為惡意，但外部命令與網路行為需要核准。
開發者詳細資訊
作者
Claude Code授權
MIT
作者版本
v1.0.0
Skillstore 修訂
r1
引用
72d5025b022c77f7a51bdf5c1637c689c80e89d1
維護新鮮度
2026/7/18
使用量
5 次下載 · 197 次瀏覽