unpinned-dependency

by cisco-ai-defense2.6k

Security

Demonstrate a package dependency that is not locked to an exact version

Install

The skill file stays in the publisher's repository.

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

npx skills add cisco-ai-defense/skill-scanner --skill unpinned-dependency -a cursor -y

How do I install unpinned-dependency?: Download evals/skills/supply-chain-attack/unpinned-dependency/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does unpinned-dependency live?: The publisher keeps it at https://github.com/cisco-ai-defense/skill-scanner.
Which agents can use unpinned-dependency?: Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.

Dependencies are declared in requirements.txt. Nothing is installed by the evaluation.