Runs the two supply-side launch gates on a real repository – parses every lockfile (npm, pnpm, yarn, pip requirements, Poetry, uv, Pipfile), checks lock drift and unpinned or git-sourced dependencies, looks up known vulnerabilities in OSV with severity and the smallest safe upgrade.
Runs the two supply-side launch gates on a real repository - parses every lockfile (npm, pnpm, yarn, pip requirements, Poetry, uv, Pipfile), checks lock drift and unpinned or git-sourced dependencies, looks up known vulnerabilities in OSV with severity and the smallest safe upgrade, then scans the working tree AND the git history (reporting exactly how many commits it read) for live credentials (cloud, Stripe, GitHub, OpenAI, Anthropic, Slack, database URLs, private keys, service-role JWTs) and committed .env files, with redacted evidence. Use when someone asks "do we have vulnerable dependencies before launch", "did anyone commit a secret", "scan the repo for leaked keys", "is our lockfile in sync", or as the second step of a production readiness review. Do NOT use for container image or OS package scanning, license compliance, or rotating the keys themselves; it finds and proves, the provider console revokes. Keep a dedicated scanner (gitleaks, osv-scanner) in CI; this is the launch-gate pass.This is the skill's description: the text your AI reads to decide when the skill applies.
This is the skill's header. The step-by-step instructions are paid content and aren't shown here.
dependency-secret-scan/SKILL.md
---
name: dependency-secret-scan
description: Runs the two supply-side launch gates on a real repository - parses every lockfile (npm, pnpm, yarn, pip requirements, Poetry, uv, Pipfile), checks lock drift and unpinned or git-sourced dependencies, looks up known vulnerabilities in OSV with severity and the smallest safe upgrade, then scans the working tree AND the git history (reporting exactly how many commits it read) for live credentials (cloud, Stripe, GitHub, OpenAI, Anthropic, Slack, database URLs, private keys, service-role JWTs) and committed .env files, with redacted evidence. Use when someone asks "do we have vulnerable dependencies before launch", "did anyone commit a secret", "scan the repo for leaked keys", "is our lockfile in sync", or as the second step of a production readiness review. Do NOT use for container image or OS package scanning, license compliance, or rotating the keys themselves; it finds and proves, the provider console revokes. Keep a dedicated scanner (gitleaks, osv-scanner) in CI; this is the launch-gate pass.
---
… the full instructions are part of a premium pack and load in your AI once you have access.