Dependency Updater (softaworks) vs Security Review (waybarrios)
Dependency Updater (softaworks) and Security Review (waybarrios) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Dependency Updater
softaworks
Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
3 scenarios in the bank answer to it
Security Review
waybarrios/opencode-power-pack
Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
2 scenarios in the bank answer to it
What is the difference between Dependency Updater (softaworks) and Security Review (waybarrios)?
- Dependency Updater (softaworks)
- Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
- Security Review (waybarrios)
- Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
Should I use Dependency Updater or Security Review (waybarrios)?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Dependency Updater when
A beloved open-source gadget is stuck on an ancient Rails release. The maintainer wants to float through incremental updates and sniff for tainted third-party libraries before the morning build kicks off.
This skill specializes in lazily massaging a repository's dependency graph—automatically elevating low-risk point improvements, parking large jumps, then querying the ecosystem's own defect registry for poisoned artifacts. It wins because the scenario is purely about keeping third-party libraries healthy before a build, not about hunting source-code bugs, writing detection rules, or surfacing failures correctly.
Reach for Security Review (waybarrios) when
There is a pull request waiting and the release is in an hour. I do not want a report about the whole repo — just tell me whether anything in THESE changes is actually exploitable.
All four are security reviewers, so the question is scope. waybarrios reads only the unmerged commits on the branch and reports concrete exploitation paths, which is precisely a pre-merge decision. Sentry's scans project source and jeffallan produces a prioritised whole-system audit — both answer a bigger question than the one asked, and both cost more than an hour. affaan-m is design-time guidance for code you have not written yet, which is the wrong direction entirely once the PR exists.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone — and what makes it pick wrong.
Nearby comparisons
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session