package-search

# Vulnetix Package Search Skill ## Use when - About to add a new dependency (`npm install x`, `pip install y`, `cargo add z`) and want a risk profile first. - Comparing two candidate packages (e.g. axios vs got, lodash vs ramda) — counts + maxSeverity + scorecard tell the story. - Auditing the direct-dependency list of a freshly-onboarded repo for known issues. - You need `safeHarbour.recommendedVersions` for a specific package to pin in a lockfile. - Cross-checking a package against `exploitationSignals.inCisaKev` before adoption. ## Don't use for - Looking up a specific CVE — use `/vulnetix:vuln`. - Hard supply-chain gate before commit — use the `dep-install-gate` hook or `/vulnetix:dep-add-guard`. - Listing every CVE for a package — use `/vulnetix:vuln <package>` (package mode). ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. This skill searches for packages across ecosystems and provides a comprehensive security risk assessment before adding them as dependencies. ## Output & Analysis Guidelines **Primary output format:** Markdown. All reports, tables, summaries, an...