How these skills work together
Start with the real manifest, lockfile and comparison base. Inspect the dependency collector before permitting it to run, then preserve assessed, flagged and unassessable results separately. Review how the code change alters a trust boundary and which callers or tests are affected. If an important behavior has a meaningful invariant, express it as a property and check it against a known failure. These stages contribute different evidence; this kit is not an independent security audit or proof that a dependency tree is safe.
Validation and boundaries
Tie findings to resolved versions, relevant code paths and reproducible consequences. Preserve failed measurements and coverage limits. Confirm that a new test detects a real missing behavior, rather than merely agreeing with the implementation, and inspect any proposed package update for compatibility and application-level regressions.