Dependency Guard
Comprehensive dependency security and health auditing. Scans known vulnerabilities (CVE),
license compatibility, outdated packages, supply-chain risk (typosquatting / maintainer
changes), and bundle-size impact — then produces a prioritized, actionable remediation plan.
When to use
- "扫一下依赖有没有安全漏洞" / "npm audit 报了一堆 CVE"
- "这些依赖过时了吗 / 该升级哪些"
- "license 合规检查" / "有没有 GPL 污染"
- "供应链安全 / typosquatting / 包被劫持"
- "依赖体积太大 / bundle size 优化"
- 发布前依赖体检 / 加固
Workflow
- Discover — inventory all dependency manifests (package.json, requirements.txt,
go.mod, Cargo.toml, pom.xml, Gemfile, composer.json…), build the dependency tree.
- Vulnerability scan — check each package against CVE/advisory databases; rate
severity (critical/high/moderate/low) and compute a risk score.
- License compliance — flag incompatible (e.g. GPL-in-MIT) and unknown licenses.
- Outdated analysis — find stale packages, prioritize by security > age > releases-behind.
- Supply-chain checks — typosquatting (Levenshtein vs popular names), maintainer
changes, suspicious install scripts.
- Size impact — flag oversized packages, suggest lighter alternatives / lazy-load.
- Remediation — generate safe update commands (with test gate + auto-revert) and a
ready-to-open update PR body.
Output
Executive summary → vulnerability report → license matrix → prioritized updates →
supply-chain findings → remediation scripts → size report → optional CI monitoring workflow.
Reference
Full multi-language detection code, scanner logic, license tables, and PR/CI templates
live in reference.md — read it when you need the concrete implementation patterns.
Notes for this environment
- Prefer running the actual ecosystem tools when available:
npm audit --json,
pip-audit / safety, osv-scanner, govulncheck, cargo audit. The reference
code shows the API shapes; real CLI output is more authoritative.
- Never auto-run
npm audit fix --force without a test gate — it can introduce breaking
major bumps. Always propose, run tests, revert on failure.
1---2name: dependency-guard3description: Dependency security & health audit across npm/Python/Go/Ruby/Java/Rust/PHP. Use when the user mentions dependency vulnerabilities, CVE scan, npm audit, outdated packages, license compliance, supply-chain / typosquatting risk, bundle-size bloat, or asks to audit / update / harden project dependencies. Produces a prioritized remediation plan with severity ratings and update PR scaffolding.4---56# Dependency Guard78Comprehensive dependency security and health auditing. Scans known vulnerabilities (CVE),9license compatibility, outdated packages, supply-chain risk (typosquatting / maintainer10changes), and bundle-size impact — then produces a prioritized, actionable remediation plan.1112## When to use1314- "扫一下依赖有没有安全漏洞" / "npm audit 报了一堆 CVE"15- "这些依赖过时了吗 / 该升级哪些"16- "license 合规检查" / "有没有 GPL 污染"17- "供应链安全 / typosquatting / 包被劫持"18- "依赖体积太大 / bundle size 优化"19- 发布前依赖体检 / 加固2021## Workflow22231. **Discover** — inventory all dependency manifests (package.json, requirements.txt,24 go.mod, Cargo.toml, pom.xml, Gemfile, composer.json…), build the dependency tree.252. **Vulnerability scan** — check each package against CVE/advisory databases; rate26 severity (critical/high/moderate/low) and compute a risk score.273. **License compliance** — flag incompatible (e.g. GPL-in-MIT) and unknown licenses.284. **Outdated analysis** — find stale packages, prioritize by security > age > releases-behind.295. **Supply-chain checks** — typosquatting (Levenshtein vs popular names), maintainer30 changes, suspicious install scripts.316. **Size impact** — flag oversized packages, suggest lighter alternatives / lazy-load.327. **Remediation** — generate safe update commands (with test gate + auto-revert) and a33 ready-to-open update PR body.3435## Output3637Executive summary → vulnerability report → license matrix → prioritized updates →38supply-chain findings → remediation scripts → size report → optional CI monitoring workflow.3940## Reference4142Full multi-language detection code, scanner logic, license tables, and PR/CI templates43live in `reference.md` — read it when you need the concrete implementation patterns.4445## Notes for this environment4647- Prefer running the actual ecosystem tools when available: `npm audit --json`,48 `pip-audit` / `safety`, `osv-scanner`, `govulncheck`, `cargo audit`. The reference49 code shows the API shapes; real CLI output is more authoritative.50- Never auto-run `npm audit fix --force` without a test gate — it can introduce breaking51 major bumps. Always propose, run tests, revert on failure.
shengdabai