dep-guard

# dep-guard LLMs invent package names that look real but do not exist, and attackers pre-register those names (slopsquatting). This skill verifies every new dependency or import against the real registry BEFORE it is added. ## Why this exists (evidence) - LLM-generated code hallucinates package names at a meaningful rate (studies report ~19.7% of suggested packages in some settings do not exist), and the same fake names recur, so attackers register them: "slopsquatting" is a real supply-chain attack vector. - A hallucinated import is at best a build break, at worst arbitrary code execution from a malicious squatted package. ## When to use - Any new `import` / `require` / `use`. - Any `pip install` / `npm install` / `cargo add` / `go get` the agent proposes. - Reviewing AI-generated code that pulls in unfamiliar deps. ## The checklist For each new dependency or import: 1. **Exists?** Confirm the package is real on its registry (npm, PyPI, crates.io, Go modules, Maven). Do not assume from the name. 2. **Right one?** Check it is the intended package, not a typosquat (e.g. `python-dateutil` vs `dateutils`, `lodash` vs `lodahs`). Compare owner, downloads, repo link, recent maintenance. 3. **Standard lib?** If the symbol is actually in the language/stdlib, do not add a dependency at all. 4. **Provenance.** Prefer packages with a real repo, downloads, and recent activity. Brand-new, zero-download package matching a "too convenient" name = red flag. 5. **API exists?** For an imported symbol/function, confirm it exists in that package's version, not a plausible-sounding invented method. 6. **Pin + lock.** Add with a pinned version and update the lockfile; never float a freshly added dep. Verdict per dep: OK (verified real + correct) / TYPO (right idea, wrong name -> correct it) / HALLUCINATED (does not exist -> remove, find the real one) / SUSPICIOUS (exists but unverified provenance -> human check). ## How to run it - Quick: check the registry/page for each new dep (WebFetch / the package manager's `info`/`view` command, e.g. `npm view <pkg>`, `pip index versions <pkg>`). - In CI: pair with a lockfile + allowlist; flag any dep not already trusted. ## Composes with - `mcp-warden` / `skill-security-scan`: same hostile-data, supply-chain mindset, for MCPs and skills. - `testsmith`: a failing import surfaces fast when tests run. ## Honest limits - It checks existence/provenance, not whether a real package is itself malicious or buggy. A verified package can still be bad; this catches hallucination/typosquat, not full audit. - Registry checks need network; offline, fall back to "unverified -> human check", never silently trust.