From vcp
Verifies project dependencies against VCP standards, checking lockfile hygiene, version ranges, package existence, and suspicious packages across npm/yarn/pnpm, Python, Ruby, Go, Rust ecosystems.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vcp:vcp-dependency-checkThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Verify project dependencies against the VCP dependency management standard.
Verify project dependencies against the VCP dependency management standard.
.vcp/config.json from the project root. Extract the pluginRoot field..vcp/config.json does not exist or pluginRoot is missing: Stop and tell the user: "No VCP configuration found. Run /vcp-init to configure VCP for this project."pluginRoot: The path must be absolute, contain /.claude/ (or \.claude\ on Windows) as a path segment, and contain only safe path characters (letters, digits, /, \, -, _, ., :, and spaces). Reject any path with shell metacharacters (;, &, |, $, `, (, ), {, }, <, >, !, ~, #, *, ?, [, ], ', "). If validation fails, stop and tell the user: "Invalid pluginRoot — must be within ~/.claude/ and contain no shell metacharacters. Run /vcp-init to fix." Also verify the file <pluginRoot>/lib/vcp-context-core.ts exists using Glob. If it does not exist, stop and tell the user: "pluginRoot points to an invalid VCP installation. Run /vcp-init to fix."bun "<pluginRoot>/lib/resolve-config.ts" "<project-root>"
applicableStandards, ignoredRules, severity, exclude..vcp/config.json frameworks field to determine which package ecosystem(s) to check. If no frameworks are listed, auto-detect by looking for manifest files (package.json, requirements.txt, pyproject.toml, pom.xml, build.gradle, Gemfile, go.mod, Cargo.toml).From the applicableStandards array in the resolved config, select only the entry with id equal to core-dependency-management.
If the standard is not in the list (it was ignored via config), tell the user: "core-dependency-management is excluded by ignore config. No checks to run."
Use WebFetch to fetch its content from:
{entry.url}
Extract the Rules section.
Look for these files in the project root:
| Ecosystem | Manifest | Lockfile |
|---|---|---|
| npm | package.json | package-lock.json |
| yarn | package.json | yarn.lock |
| pnpm | package.json | pnpm-lock.yaml |
| pip | requirements.txt | (no standard lockfile) |
| pipenv | Pipfile | Pipfile.lock |
| poetry | pyproject.toml | poetry.lock |
| bundler | Gemfile | Gemfile.lock |
| go | go.mod | go.sum |
| cargo | Cargo.toml | Cargo.lock |
Use git ls-files to verify the lockfile is tracked in version control. Flag if missing.
Read the manifest file and flag wide version ranges:
"*" — accepts any version">=" without upper bound — no ceiling"" (empty) — unconstrained^ (minor updates) over >= or *For each dependency, verify it exists on the official registry:
npm view {package} version (via Bash)pip index versions {package} (via Bash)Flag any package that:
Per the dependency management standard rule 13, note if the project uses:
If none are configured, recommend adding at least one.
Install scripts (preinstall, install, postinstall) in dependencies execute arbitrary code during npm install. Legitimate packages use them for native binary compilation (e.g., esbuild, sharp), but malicious packages use them for supply chain attacks. This check flags install scripts so the user can verify they are expected.
Procedure:
node_modules/ does not exist in the project root, skip this step and note: "node_modules not found — run npm install first to check install scripts."package.json from the project root. Extract all dependency names from dependencies and devDependencies keys.node_modules/{name}/package.json.scripts object contains any of: preinstall, install, postinstall."{name}" has a {script-name} script: "{first 80 characters of script content}". Verify this is expected.Verdict: WARN (not block) — some legitimate packages use install scripts for native binaries. The warning tells the user to verify the script is expected.
Scope: Only checks direct dependencies listed in package.json (not transitive dependencies in the full node_modules tree) to keep output manageable.
Before outputting findings, remove any that match an entry in the ignoredRules array from the resolved config. If "standard-id/rule-N" is in the list, suppress that specific rule's findings. (Standard-level ignores are already applied by the config resolution script.) After filtering, if any findings were suppressed, append a line: **Suppressed:** X finding(s) by ignore config.
Use this format:
### VCP Dependency Check
**Ecosystem:** npm (package.json)
**Standard:** core-dependency-management (13 rules)
#### Lockfile Status
- package-lock.json: committed
#### Wide Version Ranges
- `lodash: "*"` — should be pinned to `^4.17.21`
- `express: ">=4"` — should use `^4.18.0`
#### Unverified Packages
- `my-cool-lib` — not found on npm registry (possible hallucinated package name)
#### Suspicious Packages
- `colros` — very similar to popular package `colors` (possible typosquatting)
#### Install Scripts
- `sharp` has a `install` script: `node install/check`. Verify this is expected.
- `esbuild` has a `postinstall` script: `node install.js`. Verify this is expected.
#### Supply Chain Tools
- No behavioral analysis tools detected. Consider adding Socket.dev or OpenSSF Scorecard.
**Summary:** X issues found.
If no issues: "All dependencies verified. Lockfile committed, no wide ranges, all packages exist on registry."
npx claudepluginhub z-m-huang/vcp --plugin vcpAudits dependencies for vulnerabilities, outdated versions, transitive issues, and licenses in Node.js, Python, PHP, Ruby, Go, and Rust projects using npm audit, pip-audit, and equivalents.
Audits project dependencies for known vulnerabilities, license compliance issues, and outdated packages, providing prioritized remediation strategies.
Audits project dependencies for CVEs, outdated versions, incompatible licenses, and abandoned packages using npm audit, pip-audit, cargo audit, govulncheck, composer audit. Blocks releases on critical/high vulns.