Agent Skills › abbudjoe/guardtower › guardtower-dependency-preflight

guardtower-dependency-preflight

GitHub

在执行依赖安装或更新前运行 Guardtower，检查漏洞情报和本地暴露情况。根据报告结果决定是否继续变更，并在变更后进行验证和对比分析，确保依赖操作的安全性。

plugins/guardtower/skills/guardtower-dependency-preflight/SKILL.md abbudjoe/guardtower

Trigger Scenarios

执行 npm install, pnpm add, yarn add, pip install, cargo add 等依赖安装命令前更新项目依赖、包管理器配置、锁文件或 SDK 时需要评估依赖变更对安全性的影响时

Install

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -g -y

More Options

Non-standard path

npx skills add https://github.com/abbudjoe/guardtower/tree/main/plugins/guardtower/skills/guardtower-dependency-preflight -g -y

Use without installing

npx skills use abbudjoe/guardtower@guardtower-dependency-preflight

指定 Agent (Claude Code)

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -a claude-code -g -y

安装 repo 全部 skill

npx skills add abbudjoe/guardtower --all -g -y

预览 repo 内 skill

npx skills add abbudjoe/guardtower --list

SKILL.md

Frontmatter

{
    "name": "guardtower-dependency-preflight",
    "description": "Use before installing, adding, upgrading, or changing project dependencies, package managers, lockfiles, manifests, SDKs, libraries, plugins, or build tooling. Runs Guardtower first so Codex checks current vulnerability intelligence and local exposure before mutating dependency surfaces."
}

Guardtower Dependency Preflight

Use this skill before dependency mutations such as npm install, pnpm add, yarn add, bun add, pip install, uv add, poetry add, cargo add, cargo update, go get, lockfile refreshes, SDK upgrades, or framework/library installs.

Preflight

Identify the target project directory and the intended dependency change.
Run Guardtower before installing or updating packages:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json

Read the newest report path printed by Guardtower. Treat the Action View and Permission Requests as the primary triage surfaces.
If Guardtower shows package-linked findings for the target project, resolve or report them before adding more dependency churn unless the user explicitly asks to proceed.
If Guardtower reports only unmatched intel, do not block the install solely on unmatched items. Mention the residual intel briefly when relevant.

For a deterministic parser/report smoke test while editing Guardtower itself, use:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json --no-network

After The Change

After dependency files are changed:

Run the ecosystem validation that matches the project, such as npm audit, cargo check, cargo audit if available, pip-audit, or the repo's established tests.
Rerun Guardtower when the change was security-motivated or materially changes runtime dependencies.
Compare the new report's delta. Call out new, resolved, and still-present package-linked exposures.

Guardrails

Do not mutate cloud jobs, paid compute, deployments, or production resources as part of dependency preflight unless the user explicitly authorizes that action in the current turn.
Do not treat local deployment markers as proof of production deployment; rely on Guardtower deployment status, explicit config, or verified provider APIs.
Do not suppress or record review decisions without evidence. Use --record-review only after checking applicability.
Keep dependency edits scoped to the user's requested package or the minimum parent upgrades needed to remove the vulnerable package.