Analyse Dependency Graphs for Hidden Risk

When you install a package with 5 direct dependencies, you're actually installing the entire subtree — which might be 200 packages deep. One compromised package anywhere in that tree can exfiltrate credentials, inject malware, or cause a supply chain attack. Almost nobody audits transitive dependencies because the graph is too large to inspect manually.

The dependency_graph skill maps the full dependency tree for a given package, returning a structured representation of every direct and transitive dependency. Combined with package_risk, you can identify which nodes in the graph carry the most risk — without reading every one of hundreds of package.json files manually.

Security architects scoping the blast radius of a supply chain incident, developers evaluating whether a new package brings unwanted dependencies, and security tools that need full dependency inventories for SBOM (Software Bill of Materials) generation all use this to understand what they're actually running.