Agent Skills › abbudjoe/guardtower › guardtower-dependency-preflight

guardtower-dependency-preflight

GitHub

在添加或更新项目依赖前运行 Guardtower 扫描漏洞，评估风险后再执行变更，并在变更后进行验证与对比分析。

plugins/guardtower/skills/guardtower-dependency-preflight/SKILL.md abbudjoe/guardtower

Trigger Scenarios

安装新依赖包升级现有依赖修改锁文件或构建工具配置

Install

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -g -y

More Options

Non-standard path

npx skills add https://github.com/abbudjoe/guardtower/tree/main/plugins/guardtower/skills/guardtower-dependency-preflight -g -y

Use without installing

npx skills use abbudjoe/guardtower@guardtower-dependency-preflight

指定 Agent (Claude Code)

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -a claude-code -g -y

安装 repo 全部 skill

npx skills add abbudjoe/guardtower --all -g -y

预览 repo 内 skill

npx skills add abbudjoe/guardtower --list

SKILL.md

Frontmatter

{
    "name": "guardtower-dependency-preflight",
    "description": "Use before installing, adding, upgrading, or changing project dependencies, package managers, lockfiles, manifests, SDKs, libraries, plugins, or build tooling. Runs Guardtower first so Codex checks current vulnerability intelligence and local exposure before mutating dependency surfaces."
}

Guardtower Dependency Preflight

Use this skill before dependency mutations such as npm install, pnpm add, yarn add, bun add, pip install, uv add, poetry add, cargo add, cargo update, go get, lockfile refreshes, SDK upgrades, or framework/library installs.

Preflight

Identify the target project directory and the intended dependency change.
Run Guardtower before installing or updating packages:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json

Read the newest report path printed by Guardtower. Treat the Action View and Permission Requests as the primary triage surfaces.
If Guardtower shows package-linked findings for the target project, resolve or report them before adding more dependency churn unless the user explicitly asks to proceed.
If Guardtower reports only unmatched intel, do not block the install solely on unmatched items. Mention the residual intel briefly when relevant.

For a deterministic parser/report smoke test while editing Guardtower itself, use:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json --no-network

After The Change

After dependency files are changed:

Run the ecosystem validation that matches the project, such as npm audit, cargo check, cargo audit if available, pip-audit, or the repo's established tests.
Rerun Guardtower when the change was security-motivated or materially changes runtime dependencies.
Compare the new report's delta. Call out new, resolved, and still-present package-linked exposures.

Guardrails

Do not mutate cloud jobs, paid compute, deployments, or production resources as part of dependency preflight unless the user explicitly authorizes that action in the current turn.
Do not treat local deployment markers as proof of production deployment; rely on Guardtower deployment status, explicit config, or verified provider APIs.
Do not suppress or record review decisions without evidence. Use --record-review only after checking applicability.
Keep dependency edits scoped to the user's requested package or the minimum parent upgrades needed to remove the vulnerable package.