Dep guard
Dependency security — intercepts package install commands to enforce latest versions and block vulnerable packages
npx -y skills add iwritec0de/dep-guard --skill dep-guardAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
This skill should be used when the user asks to "install a package", "add a dependency", "check for vulnerabilities", "audit dependencies", or mentions "npm install", "pip install", "composer require", "yarn add", "pnpm add", "check vulnerability", "audit dependencies". Provides dependency security and version management by intercepting package installs to enforce latest versions and block vulnerable packages.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.4 KB, as published. Nobody here has run it
Dep Guard Skill
Automated dependency security enforcement. The PreToolUse hook intercepts all package install commands and enforces:
- Registry connectivity — hard-blocks if offline (can't verify = can't install)
- Latest versions — resolves and upgrades outdated version requests
- Vulnerability scanning — checks OSV.dev for known CVEs before install
How It Works
The dep-guard.py hook runs on every Bash command. If it detects an install command (npm install, pip install, composer require, etc.), it:
- Pings the registry to confirm it's reachable
- Extracts package names and requested versions
- Queries the registry for latest versions
- Queries OSV.dev for vulnerabilities against the target version
- Makes a decision:
| Condition | Action |
|---|---|
| Registry offline | BLOCK — hard stop until online |
| Scan failed | BLOCK — can't verify safety |
| Critical/High vuln | BLOCK — must find alternative |
| Medium vuln | WARN — allow with warning |
| Low/no vulns | ALLOW |
| Outdated version requested | BLOCK — provide corrected command |
| No version specified | ALLOW — will get latest automatically |
| Lockfile install (npm ci, etc.) | SKIP — no new packages |
Supported Ecosystems
| Ecosystem | Install Commands | Registry | Vuln Source |
|---|---|---|---|
| npm | npm install/i/add | npmjs.org | OSV.dev (npm) |
| yarn | yarn add | npmjs.org | OSV.dev (npm) |
| pnpm | pnpm add/install | npmjs.org | OSV.dev (npm) |
| bun | bun add/install | npmjs.org | OSV.dev (npm) |
| pip | pip install, uv add | pypi.org | OSV.dev (PyPI) |
| composer | composer require | packagist.org | OSV.dev (Packagist) |
Commands
/dep-check [package]— Check a specific package before installing/dep-audit [--fix]— Audit all installed dependencies
Logs
Debug logs are written to /tmp/dep-guard.log for troubleshooting.
Critical Rule: No Wrapper Scripts
You MUST always run package install commands directly via the Bash tool. Never create a script in any language that internally invokes a package manager to circumvent the hook.
Prohibited patterns include:
- Writing Python, Node, shell, or any other script files that run install commands internally via process spawning
- Using inline interpreter calls (e.g.
python3 -cornode -e) that wrap install commands - Using remote execution (docker, ssh) to install packages outside the hook's reach
All of these bypass the dep-guard security hook. If the hook blocks an install, that block is intentional. Do not work around it. Instead, inform the user why the install was blocked and suggest an alternative package or version.
Bypassing (Emergency Only)
If the hook blocks something incorrectly, the user can disable the plugin temporarily in .claude/settings.json. The hook should never be bypassed in normal operation.