dep-add-guard

# Vulnetix Dependency-Add Guard Skill ## Use when - Stop-think: about to run `npm install` / `pip install` / `cargo add` something new. - Choosing between candidate packages (Pix verdict tells you which is safer). - CI policy: block PRs that add packages flagged BLOCK. - Auditing a recently-added dep that was not gated at addition time. - Cross-checking the `dep-install-gate` hook's warning with full-detail follow-up. ## Don't use for - Generic package info — use `/vulnetix:package-search`. - Resolving a conflict — use `/vulnetix:dep-resolve`. - Single-CVE lookup — use `/vulnetix:vuln`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Refines `/vulnetix:package-search` into an explicit "should I add this?" verdict. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Default `--ecosystem` from `derived.primary_package_manager` if not provided. ## Step 2: Parallel intelligence pulls ```bash vulnetix vdb packages search "$PACKAGE" --ecosystem "$ECO" -o json & | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/packages.jq" vulnetix vdb vulns "$PACKAGE" -o json & | ...