| name | dep-add-guard |
| description | Pre-add risk gate for a new dependency — composes vuln history (`vdb vulns`), AI-malware check (`vdb ai-malware`), license compatibility, EOL status, maintainer health, version-lag — into one ALLOW/WARN/BLOCK verdict. Use when about to `npm install` / `pip install` / `cargo add` something new, vetting alternatives, or hardening the CI pre-add policy. |
| argument-hint | <package-name> [--version X] [--ecosystem npm|pypi|...] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["add dependency","install package","new dep","add library","require package"] |
| chain | ["package-search","dep-resolve"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Dependency-Add Guard Skill
Use when
- Stop-think: about to run
npm install / pip install / cargo add something new.
- Choosing between candidate packages (Pix verdict tells you which is safer).
- CI policy: block PRs that add packages flagged BLOCK.
- Auditing a recently-added dep that was not gated at addition time.
- Cross-checking the
dep-install-gate hook's warning with full-detail follow-up.
Don't use for
- Generic package info — use
/vulnetix:package-search.
- Resolving a conflict — use
/vulnetix:dep-resolve.
- Single-CVE lookup — use
/vulnetix:vuln.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Refines /vulnetix:package-search into an explicit "should I add this?" verdict.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Default --ecosystem from derived.primary_package_manager if not provided.
Step 2: Parallel intelligence pulls
vulnetix vdb packages search "$PACKAGE" --ecosystem "$ECO" -o json & | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/packages.jq"
vulnetix vdb vulns "$PACKAGE" -o json & | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/vulns.jq"
vulnetix vdb ai-malware list --package "$PACKAGE" -o json & | jq -f
vulnetix vdb purl -o json & | jq -f
