From dep-guard
This skill should be used when the user asks to "install a package", "add a dependency", "check for vulnerabilities", "audit dependencies", or mentions "npm install", "pip install", "composer require", "yarn add", "pnpm add", "check vulnerability", "audit dependencies". Provides dependency security and version management by intercepting package installs to enforce latest versions and block vulnerable packages.
npx claudepluginhub iwritec0de/claude-plugin-marketplace --plugin dep-guardThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Implements structured self-debugging workflow for AI agent failures: capture errors, diagnose patterns like loops or context overflow, apply contained recoveries, and generate introspection reports.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Automated dependency security enforcement. The PreToolUse hook intercepts all package install commands and enforces:
The dep-guard.py hook runs on every Bash command. If it detects an install command (npm install, pip install, composer require, etc.), it:
| Condition | Action |
|---|---|
| Registry offline | BLOCK — hard stop until online |
| Scan failed | BLOCK — can't verify safety |
| Critical/High vuln | BLOCK — must find alternative |
| Medium vuln | WARN — allow with warning |
| Low/no vulns | ALLOW |
| Outdated version requested | BLOCK — provide corrected command |
| No version specified | ALLOW — will get latest automatically |
| Lockfile install (npm ci, etc.) | SKIP — no new packages |
| Ecosystem | Install Commands | Registry | Vuln Source |
|---|---|---|---|
| npm | npm install/i/add | npmjs.org | OSV.dev (npm) |
| yarn | yarn add | npmjs.org | OSV.dev (npm) |
| pnpm | pnpm add/install | npmjs.org | OSV.dev (npm) |
| bun | bun add/install | npmjs.org | OSV.dev (npm) |
| pip | pip install, uv add | pypi.org | OSV.dev (PyPI) |
| composer | composer require | packagist.org | OSV.dev (Packagist) |
/dep-check [package] — Check a specific package before installing/dep-audit [--fix] — Audit all installed dependenciesDebug logs are written to /tmp/dep-guard.log for troubleshooting.
You MUST always run package install commands directly via the Bash tool. Never create a script in any language that internally invokes a package manager to circumvent the hook.
Prohibited patterns include:
python3 -c or node -e) that wrap install commandsAll of these bypass the dep-guard security hook. If the hook blocks an install, that block is intentional. Do not work around it. Instead, inform the user why the install was blocked and suggest an alternative package or version.
If the hook blocks something incorrectly, the user can disable the plugin temporarily in .claude/settings.json. The hook should never be bypassed in normal operation.