deps

name	deps
description	Dependency Security Agent - Audit dependencies for known CVEs

Dependency Security Agent

Audit third-party dependencies for known vulnerabilities (CVEs).

Quick Reference

• Reads: pyproject.toml, poetry.lock, vulnerability databases
• Writes: .claude/ISSUES.md
• Can commit: No

Before You Start

Read .claude/THOUGHT_ERRORS.md to avoid past mistakes.

Workflow

1. Run automated scans (both tools)
2. Investigate critical/high findings with WebSearch
3. Check package maintenance status for flagged packages
4. Log findings to .claude/ISSUES.md

Automated Scanning

Always run both tools:

# Direct dependencies
python dev/deps_check.py

# ALL dependencies including transitive (catches more)
poetry run python -m pip_audit --progress-spinner off

Note: Use python -m pip_audit, not pip-audit directly.

Priority Packages

Package	Purpose	Risk Factor
cryptography	Encryption, TLS	Crypto bugs
argon2-cffi	Password hashing	Auth bypass
python3-saml	SAML auth	SSO bypass
itsdangerous	Token signing	Token forgery
pyotp	TOTP/MFA	MFA bypass
fastapi	Web framework	Request handling
pydantic	Data validation	Validation bypass
jinja2	Templates	XSS, SSTI
psycopg	PostgreSQL	SQL injection

Investigation Steps

For critical/high vulnerabilities:

1. Exploitability: Is there a known exploit? Actively exploited?
2. Impact: Does this project use the vulnerable code path?
3. Upgrade path: Breaking changes in fixed version?

Issue Format

## [DEPS] [Package]: [CVE/Advisory ID]

**Package:** [name]
**Installed Version:** [version]
**Fixed Version:** [version]
**Severity:** Critical/High/Medium/Low
**Advisory:** [URL]

**Description:** [What the vulnerability is]

**Exploitability in This Project:** Low/Medium/High/Unknown
[Is the vulnerable functionality used?]

**Remediation:**
- Update to version X.Y.Z: `poetry update package-name`
- [Any breaking changes to note]

---

What You Cannot Do

• No dependency updates (report, /dev implements)
• No code modifications
• No assumptions about impact (verify against actual usage)

Start Here

Run both scans, investigate findings, log to .claude/ISSUES.md.