Agent Skills › abbudjoe/guardtower › guardtower-dependency-preflight

guardtower-dependency-preflight

GitHub

在添加或更新项目依赖前运行 Guardtower 扫描，检查漏洞情报和本地暴露情况。根据报告结果决定是解决风险还是继续安装，并在变更后进行生态验证和对比分析，确保依赖变更的安全性。

plugins/guardtower/skills/guardtower-dependency-preflight/SKILL.md abbudjoe/guardtower

触发场景

执行 npm install, pip install 等依赖安装命令前更新项目包管理器或锁定文件时升级 SDK、库或构建工具前

安装

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -g -y

更多选项

非标准路径

npx skills add https://github.com/abbudjoe/guardtower/tree/main/plugins/guardtower/skills/guardtower-dependency-preflight -g -y

不安装直接使用

npx skills use abbudjoe/guardtower@guardtower-dependency-preflight

指定 Agent (Claude Code)

npx skills add abbudjoe/guardtower --skill guardtower-dependency-preflight -a claude-code -g -y

安装 repo 全部 skill

npx skills add abbudjoe/guardtower --all -g -y

预览 repo 内 skill

npx skills add abbudjoe/guardtower --list

SKILL.md

Frontmatter

{
    "name": "guardtower-dependency-preflight",
    "description": "Use before installing, adding, upgrading, or changing project dependencies, package managers, lockfiles, manifests, SDKs, libraries, plugins, or build tooling. Runs Guardtower first so Codex checks current vulnerability intelligence and local exposure before mutating dependency surfaces."
}

Guardtower Dependency Preflight

Use this skill before dependency mutations such as npm install, pnpm add, yarn add, bun add, pip install, uv add, poetry add, cargo add, cargo update, go get, lockfile refreshes, SDK upgrades, or framework/library installs.

Preflight

Identify the target project directory and the intended dependency change.
Run Guardtower before installing or updating packages:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json

Read the newest report path printed by Guardtower. Treat the Action View and Permission Requests as the primary triage surfaces.
If Guardtower shows package-linked findings for the target project, resolve or report them before adding more dependency churn unless the user explicitly asks to proceed.
If Guardtower reports only unmatched intel, do not block the install solely on unmatched items. Mention the residual intel briefly when relevant.

For a deterministic parser/report smoke test while editing Guardtower itself, use:

python3 /Users/joseph/guard/plugins/guardtower/scripts/guardtower.py --config /Users/joseph/guard/plugins/guardtower/config.json --no-network

After The Change

After dependency files are changed:

Run the ecosystem validation that matches the project, such as npm audit, cargo check, cargo audit if available, pip-audit, or the repo's established tests.
Rerun Guardtower when the change was security-motivated or materially changes runtime dependencies.
Compare the new report's delta. Call out new, resolved, and still-present package-linked exposures.

Guardrails

Do not mutate cloud jobs, paid compute, deployments, or production resources as part of dependency preflight unless the user explicitly authorizes that action in the current turn.
Do not treat local deployment markers as proof of production deployment; rely on Guardtower deployment status, explicit config, or verified provider APIs.
Do not suppress or record review decisions without evidence. Use --record-review only after checking applicability.
Keep dependency edits scoped to the user's requested package or the minimum parent upgrades needed to remove the vulnerable package.