aibot88 Task: Security/Dependency Audit Before Deploy
Priority: High Category: Security Effort: Small — one new skill + one babysitter gate
Problem
Current security model defends against agent misbehavior (command blocklist, path sandbox, TruffleHog). It does NOT protect against supply chain risk:
- Dependency CVEs
- Malicious npm packages
- Unsafe Docker base images
A Developer could introduce a vulnerable dependency and it would pass review, QA, and deploy.
What to Build
A security-audit skill that runs before DevOps deploys.
Tools to invoke (per stack, auto-detected)
| Stack | Command |
|---|---|
| Node.js | npm audit --audit-level=high |
| Python | pip-audit |
| Rust | cargo audit |
| Docker | trivy image <image> |
| General | trivy fs . |
Integration points
- Add
security_audit_passedas a new babysitter gate indevopsagent (mirrors Developer's babysitter gates) - If audit finds HIGH/CRITICAL CVEs → post
[ESCALATION]to Linear, block deploy - If audit finds MODERATE → post warning comment, allow deploy
- Audit result summary appended to the deploy comment
Files to change
extensions/clawe-scheduler/src/guards/babysitter.ts— addsecurity_audit_passedgateskills/security-audit/SKILL.md— new skillextensions/clawe-scheduler/src/agents/tool-executor.ts— add audit commands to allowed list
Acceptance Criteria
-
npm auditruns automatically before every deploy on Node.js projects - HIGH/CRITICAL CVEs block the deploy with an
[ESCALATION]comment - Audit result is visible in the Linear deploy comment
- Gate is skipped gracefully if stack is undetected (no false blocks)