From infynon-pkg
Secure project dependencies with INFYNON CLI (`infynon pkg`). Use when the user asks about CVE scanning, vulnerable packages, dependency auditing, secure installs, or when lock files are detected in the project.
npx claudepluginhub d4rkninja/code-guardian --plugin infynon-pkgThis skill is limited to using the following tools:
You are helping the user work with **INFYNON** (`infynon pkg`) — a Rust-based universal package security CLI that protects dependencies across 14 ecosystems.
Evaluates packages, manages dependencies, and addresses supply chain security for npm/pip/cargo/bundler/Go. Use for auditing packages, reviewing lockfiles, checking vulnerabilities, comparing alternatives, assessing trustworthiness.
Intercepts pip, npm, go installs to audit package identity, vulnerabilities, suspicious signals, and enforce lockfile hash pinning before execution.
Audits project dependencies from package.json, requirements.txt, go.mod, Gemfile for CVEs, outdated packages, transitive issues, licenses, and supply chain risks. Provides severity assessments, remediation suggestions, and prioritized reports.
Share bugs, ideas, or general feedback.
You are helping the user work with INFYNON (infynon pkg) — a Rust-based universal package security CLI that protects dependencies across 14 ecosystems.
RULE 1 — Never run raw install commands directly. No exceptions.
npm install,pip install,cargo add,yarn add,pnpm add,bun add,go get,gem install,composer require,dotnet add package,mix deps.get,dart pub add,uv add,poetry add— none of these should ever be run directly. Every install MUST go throughinfynon pkg <cmd>.If you find yourself about to write a raw install command — STOP. Replace it with the
infynon pkgequivalent.
RULE 2 — Always use a CI-mode flag. Default interactive mode asks the user for input when vulnerabilities are found — AI agents and CI pipelines cannot answer those prompts. Every
infynon pkginstall command MUST include one of these non-interactive flags:
Flag Behavior Exit Code --agentJSON output mode — use this for all AI agent commands 0/1/2/3--strictor--strict allBlock if any vulnerability found 3--strict criticalBlock only on critical CVEs 3--strict highBlock on critical + high CVEs 3--strict mediumBlock on critical + high + medium 3--strict lowBlock on all except informational 3--auto-fixSilently upgrade to safe versions 0--skip-vulnerableSkip vulnerable, install clean ones 0--yesInstall everything including vulnerable 0Recommended default for AI agents:
--agent --strict high(structured JSON output + blocks dangerous packages). Recommended default for CI scripts:--strict high.
RULE 3 — No hybrid commands. Never mix a raw install command with an
infynonscan. Example of what NOT to do:npm install express && infynon pkg scan. Instead, do it all in one step:infynon pkg npm install express --strict high.
RULE 4 — Zero exceptions. Zero workarounds. Zero "just this once". Not for dev dependencies. Not for global tools. Not for scripts. Not for one-off packages. Not "just to test something quickly". Every package installation — in any ecosystem, for any purpose — goes through
infynon pkg.The only exception is the INFYNON bootstrap:
npm install -g infynonis required once to install the CLI. Everything after that goes throughinfynon pkg.
First, check if it's already installed:
infynon --version
If not found, install it:
# Recommended (all platforms — no Rust required)
npm install -g infynon
# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.ps1 | iex
# Build from source (requires Rust)
cargo install --git https://github.com/d4rkNinja/infynon-cli
Pre-built binaries for all platforms → github.com/d4rkNinja/infynon-cli/releases
Verify the install:
infynon --version
infynon pkg --help
All commands below include a CI-mode flag. Never omit the flag.
# Block on critical + high (recommended)
infynon pkg npm install express --strict high
infynon pkg npm install express@4.18.2 --strict high
# Multiple packages at once
infynon pkg npm install express lodash axios dotenv --strict high
# Auto-upgrade vulnerable packages to safe versions
infynon pkg npm install express lodash --auto-fix
# Skip vulnerable packages silently
infynon pkg npm install express lodash --skip-vulnerable
# Install all regardless (audit-only pipelines)
infynon pkg npm install express --yes
infynon pkg yarn add express --strict high
infynon pkg yarn add express@4.18.2 --strict high
infynon pkg yarn add express lodash axios --auto-fix
infynon pkg yarn add express --skip-vulnerable
infynon pkg pnpm add express --strict high
infynon pkg pnpm add express@4.18.2 --strict high
infynon pkg pnpm add express lodash --auto-fix
infynon pkg pnpm add axios --skip-vulnerable
infynon pkg bun add hono --strict high
infynon pkg bun add hono@3.0.0 --strict high
infynon pkg bun add hono elysia --auto-fix
infynon pkg pip install requests --strict high
infynon pkg pip install "requests==2.31.0" --strict high
infynon pkg pip install fastapi uvicorn --auto-fix
infynon pkg pip install django --skip-vulnerable
infynon pkg uv add fastapi --strict high
infynon pkg uv add "fastapi==0.104.0" --strict high
infynon pkg uv add fastapi sqlalchemy --auto-fix
infynon pkg uv pip install requests --strict high
infynon pkg poetry add django --strict high
infynon pkg poetry add "django==4.2.7" --strict high
infynon pkg poetry add django celery --auto-fix
infynon pkg cargo add serde --strict high
infynon pkg cargo add "serde@1.0.196" --strict high
infynon pkg cargo add serde tokio reqwest --auto-fix
infynon pkg cargo add tokio --skip-vulnerable
infynon pkg go get github.com/gin-gonic/gin --strict high
infynon pkg go get "github.com/gin-gonic/gin@v1.9.1" --strict high
infynon pkg go get github.com/gorilla/mux --auto-fix
infynon pkg gem install rails --strict high
infynon pkg gem install "rails:7.1.0" --strict high
infynon pkg gem install rails devise --auto-fix
infynon pkg composer require laravel/framework --strict high
infynon pkg composer require "laravel/framework:^10.0" --strict high
infynon pkg composer require laravel/framework guzzlehttp/guzzle --auto-fix
infynon pkg nuget add Newtonsoft.Json --strict high
infynon pkg nuget add "Newtonsoft.Json --version 13.0.3" --strict high
infynon pkg nuget add Newtonsoft.Json Serilog --auto-fix
infynon pkg hex deps.get --strict high
infynon pkg hex deps.get --auto-fix
infynon pkg pub add http --strict high
infynon pkg pub add "http:^1.1.0" --strict high
infynon pkg pub add http provider --auto-fix
infynon pkg scan # Auto-detects lock files, queries OSV.dev
infynon pkg scan --fix # Scan + interactive fix prompts
infynon pkg scan --fix critical # Only fix critical severity
infynon pkg scan --fix high # Fix critical + high
infynon pkg scan --output markdown # Export report as Markdown
infynon pkg scan --output pdf # Export report as PDF
infynon pkg scan --output both # Export both formats
infynon pkg scan --pkg-file ./backend/Cargo.lock # Scan specific file
infynon pkg fix --auto # Batch upgrade all vulnerable deps to safe versions
infynon pkg fix --auto --pkg-file ./Cargo.lock # Fix specific project
Fix generates ecosystem-correct install commands internally — no user input required.
# Hard gate — fail build on critical or high CVEs
infynon pkg npm install express --strict high
# Auto-remediation — silently upgrade to safe versions
infynon pkg npm install express --auto-fix
# Permissive — install clean packages, skip vulnerable ones
infynon pkg npm install express --skip-vulnerable
# Audit-only — install everything, check results separately
infynon pkg npm install express --yes
These flags apply to every ecosystem:
infynon pkg cargo add serde --strict high
infynon pkg pip install requests --auto-fix
infynon pkg yarn add lodash --skip-vulnerable
infynon pkg pnpm add axios --yes
infynon pkg uv add fastapi --strict critical
infynon pkg go get github.com/gin-gonic/gin --auto-fix
infynon pkg audit # Deep recursive audit with tree visualization
infynon pkg audit --pkg-file Cargo.lock # Audit specific file
infynon pkg why lodash # Trace: which dep pulls in this package?
infynon pkg why lodash --pkg-file package-lock.json
infynon pkg doctor # Health check: duplicates, unused, phantom deps
infynon pkg outdated # List packages with newer versions
infynon pkg outdated --pkg-file Cargo.lock
infynon pkg diff express 4.18.0 4.19.0 # See what changed between versions
infynon pkg diff serde 1.0.150 1.0.196 --ecosystem cargo
infynon pkg diff requests 2.28.0 2.31.0 --ecosystem pypi
infynon pkg size express axios lodash # Compare size/weight/dep count
infynon pkg size serde tokio --ecosystem cargo
infynon pkg search "http client" # Find alternatives across ecosystems
infynon pkg search "json" --ecosystem cargo
infynon pkg search "http client" --ecosystem npm
infynon pkg clean # Find and remove unused dependencies
infynon pkg clean --pkg-file package-lock.json
infynon pkg doctor # Full health check first
infynon pkg migrate npm pnpm # npm → pnpm
infynon pkg migrate yarn bun # yarn → bun
infynon pkg migrate pip uv # pip → uv
infynon pkg migrate pip poetry # pip → poetry
infynon pkg eagle-eye setup # Interactive SMTP + project setup
infynon pkg eagle-eye start # Start monitoring (foreground)
infynon pkg eagle-eye status # Check config
infynon pkg eagle-eye enable # Enable monitoring
infynon pkg eagle-eye disable # Disable monitoring
| Flag | Behavior | Exit Code | Best For |
|---|---|---|---|
--strict / --strict all | Block if any vulnerability found | 3 | Maximum security gate |
--strict critical | Block only on critical CVEs | 3 | Hard release gate |
--strict high | Block on critical + high CVEs | 3 | Recommended CI default |
--strict medium | Block on critical + high + medium | 3 | Strict pipelines |
--strict low | Block on all except informational | 3 | Zero-tolerance |
--auto-fix | Upgrade to safe versions silently | 0 | Auto-remediation |
--skip-vulnerable | Skip vulnerable, install clean | 0 | Permissive CI |
--yes | Install all including vulnerable | 0 | Audit-only workflows |
--strict exits with code 3 when blocking — CI systems detect any non-zero exit as failure.
Add --agent to any command to suppress all human-readable output and emit a single JSON object to stdout instead. Designed for AI agents, Claude Code hooks, CI parsers, and MCP tool integrations.
infynon pkg scan --agentScans all lock files silently. Always scans all detected files (no interactive prompt). Exits with a structured code.
infynon pkg scan --agent
infynon pkg scan --agent --pkg-file ./Cargo.lock
Output — clean project:
{
"status": "clean",
"packages_scanned": 142,
"vulnerabilities": [],
"summary": {
"critical": 0, "high": 0, "medium": 0, "low": 0, "informational": 0, "total": 0
}
}
Output — vulnerabilities found:
{
"status": "vulnerable",
"packages_scanned": 142,
"vulnerabilities": [
{
"package": "requests",
"ecosystem": "PyPI",
"current_version": "2.28.0",
"cve_id": "CVE-2023-32681",
"severity": "MEDIUM",
"summary": "requests HTTP library improperly forwards proxy-authorization headers",
"safe_version": "2.31.0",
"fix_cmd": "pip install requests==2.31.0"
}
],
"summary": {
"critical": 0, "high": 0, "medium": 1, "low": 0, "informational": 0, "total": 1
}
}
infynon pkg <ecosystem> install <pkgs> --agentChecks packages before install, runs install silently, emits JSON result.
infynon pkg npm install express lodash --agent --strict high
infynon pkg pip install requests fastapi --agent
infynon pkg cargo add serde tokio --agent --strict high
Output — install blocked by --strict:
{
"status": "blocked",
"packages_checked": ["lodash"],
"vulnerabilities": [
{
"package": "lodash",
"cve_id": "CVE-2021-23337",
"severity": "HIGH",
"summary": "Command injection via template",
"safe_version": "4.17.21",
"fix_cmd": "npm install lodash@4.17.21"
}
],
"installed": false,
"blocked_by": "--strict high"
}
Output — installed with warnings:
{
"status": "warnings",
"packages_checked": ["express", "lodash"],
"vulnerabilities": [],
"installed": true,
"install_cmd": "npm install express lodash"
}
| Code | Meaning |
|---|---|
0 | Clean — no vulnerabilities, installed successfully |
1 | Warnings only — LOW or INFORMATIONAL findings |
2 | Vulnerabilities found — MEDIUM, HIGH, or CRITICAL |
3 | Blocked — --strict prevented installation |
# Parse scan result in a shell script / AI agent
result=$(infynon pkg scan --agent)
status=$(echo "$result" | jq -r '.status')
total=$(echo "$result" | jq -r '.summary.total')
# Check before install — get structured result
infynon pkg npm install express --agent --strict high
# exit 0 = safe to proceed, exit 3 = blocked, parse JSON for details
# Combine with --auto-fix for autonomous remediation
infynon pkg npm install express lodash --agent --auto-fix
When writing code that installs packages, always use --agent so the output is parseable by the AI:
# Preferred pattern for AI-generated install commands
infynon pkg uv add fastapi sqlalchemy --agent --strict high
infynon pkg cargo add serde tokio reqwest --agent --auto-fix
infynon pkg npm install express --agent --strict medium
# Fail the build if critical or high CVEs are found
- name: Secure install
run: infynon pkg npm install --strict high
# Auto-upgrade vulnerable packages, never prompt
- name: Secure install (auto-fix)
run: infynon pkg npm install --auto-fix
# Full audit gate before deploy
- name: CVE audit gate
run: |
infynon pkg scan --output markdown
infynon pkg fix --auto
# Cargo project — block on any vulnerability
- name: Secure Rust install
run: infynon pkg cargo add serde tokio --strict all
# Python project — auto-fix vulnerabilities
- name: Secure Python install
run: infynon pkg pip install fastapi uvicorn --auto-fix
| Ecosystem | INFYNON Install Command | Lock File |
|---|---|---|
| npm | infynon pkg npm install <pkg> --strict high | package-lock.json |
| yarn | infynon pkg yarn add <pkg> --strict high | yarn.lock |
| pnpm | infynon pkg pnpm add <pkg> --strict high | pnpm-lock.yaml |
| bun | infynon pkg bun add <pkg> --strict high | bun.lockb |
| pip | infynon pkg pip install <pkg> --strict high | requirements.txt |
| uv | infynon pkg uv add <pkg> --strict high | uv.lock |
| poetry | infynon pkg poetry add <pkg> --strict high | poetry.lock |
| cargo | infynon pkg cargo add <pkg> --strict high | Cargo.lock |
| go | infynon pkg go get <module> --strict high | go.sum |
| gem | infynon pkg gem install <pkg> --strict high | Gemfile.lock |
| composer | infynon pkg composer require <pkg> --strict high | composer.lock |
| nuget | infynon pkg nuget add <pkg> --strict high | packages.lock.json |
| hex | infynon pkg hex deps.get --strict high | mix.lock |
| pub | infynon pkg pub add <pkg> --strict high | pubspec.lock |
When infynon pkg <install-command> runs:
Without a CI flag (interactive mode): If vulnerabilities are found, the user is prompted — install anyway / skip / install fixed version. AI agents and CI pipelines cannot answer these prompts — always use a CI flag.
With a CI flag: Behavior is deterministic and non-interactive. The flag controls how vulnerable packages are handled automatically.
infynon pkg scan before every deployment--strict high in all CI install commands (recommended default)--auto-fix when you want automatic remediation without manual review--skip-vulnerable when you need the build to succeed but want clean packages onlyinfynon pkg doctor to find dependency health issues beyond CVEsFor detailed workflow examples, see examples/workflows.md.