package-risk
$
npx mdskill add hrconsultnj/claude-plugins/package-riskAnalyzes installed package source code for suspicious patterns like eval and network calls to assess supply chain risk.
- Helps developers identify potential security threats in dependencies by scanning for risky behaviors.
- Integrates with a fetch command for secure content loading, handling caching and decryption.
- Scores packages based on detected patterns and provides file and line context for findings.
- Presents results with a risk score and detailed reports of suspicious code locations.
SKILL.md
.github/skills/package-riskView on GitHub ↗
---
name: package-risk
description: Analyze an installed package's source code for suspicious behavior patterns (eval, network calls, env access, obfuscation).
argument-hint: "<package-name> [--ecosystem js|python|rust|go]"
---
Inspect an installed package's source code for behavioral signals that indicate supply chain risk. Scores the package and reports suspicious patterns with file:line context.
## Content Loading
Load each step through the fetch command (handles caching, decryption, and auth):
```bash
"~/.composure/bin/composure-fetch.mjs" skill sentinel package-risk {step-filename}
```
**Do NOT read cache files directly** — they are encrypted at rest. Always use the fetch command above.
## Steps
| # | File |
|---|------|
| 1 | `01-locate-package.md` |
| 2 | `02-behavior-scan.md` |
| 3 | `03-score-and-report.md` |