Instruction file imported from the-missing-pink/ai-repository-security-baseline (.cursor/rules/05-dependencies.mdc). Copyright stays with the author.

Dependency & Supply Chain Security

Name: 05-dependencies
Author: the-missing-pink

Adding Dependencies

NEVER add new dependencies without user approval.
When proposing, include: name, version, purpose, popularity, license, and known vulnerabilities.
Prefer well-established, widely-used packages.
Pin exact versions in lock files.
Verify package names carefully to avoid typosquatting.

Lock Files

NEVER delete or regenerate lock files without explicit approval.
Lock file changes must be reviewed carefully.
Resolve conflicts in lock files carefully — never simply regenerate.

Vulnerability Response

If you discover a known vulnerability, warn the user immediately.
Propose the minimal update needed to resolve it.
Never ignore or suppress vulnerability warnings.

Package Verification

Check that package sources match expected repositories.
Be suspicious of packages with very few downloads or very new publish dates.
Never install packages from URLs, git repos, or local paths without review.

{ "ocm": "1", "id": "the-missing-pink-ai-repository-security-baseline-05-depe-20a4e4", "kind": "skill", "name": "05-dependencies", "description": "Supply chain security rules for dependency management.", "publisher": "the-missing-pink", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github-cursor-rules" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Supply chain security rules for dependency management." ], "primary": false, "metadata": { "source": { "provider": "github-cursor-rules", "repository": "https://github.com/the-missing-pink/ai-repository-security-baseline", "path": ".cursor/rules/05-dependencies.mdc", "ref": "a973d838b0784ead6f3d2c4c30f03ef14e82e957", "url": "https://github.com/the-missing-pink/ai-repository-security-baseline/blob/a973d838b0784ead6f3d2c4c30f03ef14e82e957/.cursor/rules/05-dependencies.mdc", "key": "the-missing-pink/ai-repository-security-baseline/.cursor/rules/05-dependencies.mdc" }, "applies_to": [ "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "requirements.txt", "Pipfile", "poetry.lock", "Cargo.toml", "Cargo.lock", "go.mod", "go.sum", "Gemfile", "Gemfile.lock" ] }, "instructions": "# Dependency & Supply Chain Security\n\n## Adding Dependencies\n\n- NEVER add new dependencies without user approval.\n- When proposing, include: name, version, purpose, popularity, license, and known vulnerabilities.\n- Prefer well-established, widely-used packages.\n- Pin exact versions in lock files.\n- Verify package names carefully to avoid typosquatting.\n\n## Lock Files\n\n- NEVER delete or regenerate lock files without explicit approval.\n- Lock file changes must be reviewed carefully.\n- Resolve conflicts in lock files carefully — never simply regenerate.\n\n## Vulnerability Response\n\n- If you discov", "cost": { "context_tokens": 248 } }

05-dependencies

About

Dependency & Supply Chain Security

Adding Dependencies

Lock Files

Vulnerability Response

Package Verification

Use it

Manifest

Reviews