machenjie dependency-vulnerability-scanning
Registry Trigger
Use when
- dependency changes or advisories need vulnerability reachability, malicious-package, license, provenance, install-time execution, or exception review
Do not use when
- only package-manager mechanics or version selection changes and no package-risk acceptance is required
Skill Role
Accept package risk only after resolving the dependency graph. Leave version selection, lockfile mechanics, and package removal to package-dependency-management.
High-Value Rules
- Map the resolved graph delta before judging risk: direct owner, transitive paths, runtime/build/test/CI placement, optional features, platform variants, and affected artifacts.
- Calibrate a vulnerability from reachability, attacker control, privilege, exposure, exploit prerequisites, fix availability, and compensating controls; reject scanner severity alone as the acceptance decision.
- Treat install scripts, build plugins, generators, native hooks, and package-manager lifecycle code as executable supply-chain edges even when the vulnerable runtime API is unreachable.
- Verify registry and namespace resolution, integrity metadata, artifact provenance, publisher or maintainer changes, and source-to-package identity when origin trust can change.
- Derive license handling from the actual distribution, linking, modification, hosted-service, and asset-use model.
- Route legal interpretation to the accountable policy owner.
- Bind an exception to package and version, dependency path, artifact scope, reachability claim, owner, expiry, remediation, and recheck triggers; graph, advisory, publisher, or use-path changes invalidate reuse.
- Tie SBOM and scanner evidence to the built artifact or release profile it describes, not merely to a manifest snapshot.
Anti-Patterns
- A clean CVE scan does not cover malicious packages, install-time execution, license obligations, provenance loss, or advisories published after the scan.
- “Dev-only” or “not reachable” is incomplete when build agents, test inputs, release credentials, optional features, or future graph edges can activate the package.
- Reviewing one manifest line while ignoring lockfile and transitive changes hides the actual executable delta.
Stop Conditions
- Escalate suspected tampering, ambiguous registry resolution, executable hooks with sensitive access, unknown license authority, or a reachable material vulnerability without an accepted repair or containment path.
- Stop package-risk approval when the resolved graph, affected artifact, scanner/advisory freshness, or exception owner cannot be established.
Output Contract
- Return a dependency-risk decision: state graph delta, reachability, execution origin, license evidence, remediation, bounded exceptions, and proof limits
Targeted References
| Path | Type | Load when | Do not load when | Required by | Required output |
|---|---|---|---|---|---|
| benchmarks and patterns | benchmark-pattern | vulnerability origin license remediation or exception signals compete | one current graph and policy path resolves package risk without comparison | analysis-agent, task-agent, review-agent | option-comparison, selected-approach |
| checklist | decision-checklist | resolved graph delta needs reachability execution origin license remediation and exception closure | no dependency graph or package-risk acceptance changes | analysis-agent, task-agent, review-agent | checklist-result, residual-risk |
| evidence patterns | evidence-pattern | scanner reachability provenance license SBOM or exception claims need fresh proof | no package-risk claim is being accepted | analysis-agent, task-agent, review-agent | evidence-record, proof-limit, residual-risk |