ce-probe-depslisted

Statically scan a repository's pinned dependency manifests against the OSV.dev advisory database — known-vulnerable versions (CVE/GHSA advisories) per exactly-pinned package, with loud offline degradation, never a silent pass. Deterministic stdlib floor (sca-guard.py over requirements.txt / npm lockfiles) enriched by model triage; only package name+version coordinates ever leave the machine (disclosed; --offline honored). Read-only on code; findings, not verdicts. Triggers: scan/audit/check dependencies for known CVEs or vulnerable versions, SCA, software composition analysis. For manifest *misconfiguration* (IaC/k8s/Dockerfile) use /ce-probe-infra; undeclared/typosquat NEW dependencies in a change are dep-guard's job inside the implement lane.
relusion/vg-sdlc-claude-plugins · ★ 0 · AI & Automation · score 75

Install: claude install-skill relusion/vg-sdlc-claude-plugins

# Probe Deps **Invocation input:** scan scope and flags: $ARGUMENTS Statically audit the repository's dependency pins for **known vulnerabilities**: every exactly-pinned package the deterministic floor can parse is checked against the OSV.dev advisory database, and each hit is triaged into an evidence-bound finding. This is the SCA probe — the standard automated security control a serious team expects to exist. It complements, never duplicates, the neighbors: `/ce-probe-infra` audits manifest *misconfiguration*; `dep-guard.py` (inside the implement lane) gates *new undeclared* dependencies entering a change. This probe asks a third question: **are the versions already pinned here publicly known-bad?** ## Runtime Inputs - **Scope path** (optional): subtree to scan; default repo root. - **`--offline`** (optional): never touch the network — the floor degrades loudly and the report is explicitly labeled not-scanned. - **Repository manifests:** `requirements*.txt`, `requirements/*.txt`, `package-lock.json`, `package.json` (exact pins only). ## Execution Contract 0. **Session write lease (structural, first act).** `python3 "${CLAUDE_SKILL_DIR}/scripts/write-lease.py" --set --skill ce-probe-deps --allow 'docs/dep-audits/**'` — only the dated report + evidence are writable, and the write guard now enforces that. Last act: `python3 "${CLAUDE_SKILL_DIR}/scripts/write-lease.py" --restore-baseline`. A denied write mid-session means this contract and the action disagree — recon