Dependency Updater (softaworks) vs What Leaked About You (useosint)
Dependency Updater (softaworks) and What Leaked About You (useosint) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Dependency Updater
softaworks
Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
3 scenarios in the bank answer to it
What Leaked About You
useosint
Checks an email, username, phone, or name against curated data-breach services — Have I Been Pwned, DeHashed, IntelX and the like — to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything — reading the exposure is the whole job.
2 scenarios in the bank answer to it
What is the difference between Dependency Updater (softaworks) and What Leaked About You (useosint)?
- Dependency Updater (softaworks)
- Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
- What Leaked About You (useosint)
- Checks an email, username, phone, or name against curated data-breach services — Have I Been Pwned, DeHashed, IntelX and the like — to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything — reading the exposure is the whole job.
Should I use Dependency Updater or What Leaked About You?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Dependency Updater when
A beloved open-source gadget is stuck on an ancient Rails release. The maintainer wants to float through incremental updates and sniff for tainted third-party libraries before the morning build kicks off.
This skill specializes in lazily massaging a repository's dependency graph—automatically elevating low-risk point improvements, parking large jumps, then querying the ecosystem's own defect registry for poisoned artifacts. It wins because the scenario is purely about keeping third-party libraries healthy before a build, not about hunting source-code bugs, writing detection rules, or surfacing failures correctly.
Reach for What Leaked About You when
While cleaning out a dusty server closet, you spot a sticky note with your 2014 gaming alias. You dive into dump trawlers to see which tiny subscription box sites and forgotten hobby forums once held that string, purely to build a hit list, never to touch a password field.
This skill performs targeted reconnaissance on a single individual’s historical data exposure, querying compiled leak indexes to discover which external services originally stored a given identifier, without attempting to exploit or access anything. It wins here because your scenario explicitly describes trawling dumps to catalogue which small third-party businesses once held your old tag, which maps exactly to that exposure-readout mission, whereas the other options focus on writing code scanners, patching dependencies, or sanitizing server error output.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone — and what makes it pick wrong.
Nearby comparisons
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session