Dependency Vulnerability Scanning

---
name: dependency-vulnerability-scanning
description: "`analysis-agent`/`task-agent`/`review-agent`: use when dependencies change or vulnerability, license, transitive, lockfile, or SBOM risk needs review; skip unrelated work."
---

# dependency-vulnerability-scanning

## Registry Trigger

**Use when**

- dependency changes or advisories need vulnerability reachability, malicious-package, license, provenance, install-time execution, or exception review

**Do not use when**

- only package-manager mechanics or version selection changes and no package-risk acceptance is required

## Skill Role

Accept package risk only after resolving the dependency graph. Leave version selection, lockfile mechanics, and package removal to `package-dependency-management`.

## High-Value Rules

- Map the resolved graph delta before judging risk: direct owner, transitive paths, runtime/build/test/CI placement, optional features, platform variants, and affected artifacts.
- Calibrate a vulnerability from reachability, attacker control, privilege, exposure, exploit prerequisites, fix availability, and compensating controls; reject scanner severity alone as the acceptance decision.
- Treat install scripts, build plugins, generators, native hooks, and package-manager lifecycle code as executable supply-chain edges even when the vulnerable runtime API is unreachable.
- Verify registry and namespace resolution, integrity metadata, artifact provenance, publisher or maintainer changes, and source-to-package identity when origin trust can change.
- Derive license handling from the actual distribution, linking, modification, hosted-service, and asset-use model.
- Route legal interpretation to the accountable policy owner.
- Bind an exception to package and version, dependency path, artifact scope, reachability claim, owner, expiry, remediation, and recheck triggers; graph, advisory, publisher, or use-path changes invalidate reuse.
- Tie SBOM and scanner evidence to the built artifact or release profile it describes, not merely to a manifest snapshot.

## Anti-Patterns

- A clean CVE scan does not cover malicious packages, install-time execution, license obligations, provenance loss, or advisories published after the scan.
- “Dev-only” or “not reachable” is incomplete when build agents, test inputs, release credentials, optional features, or future graph edges can activate the package.
- Reviewing one manifest line while ignoring lockfile and transitive changes hides the actual executable delta.

## Stop Conditions

- Escalate suspected tampering, ambiguous registry resolution, executable hooks with sensitive access, unknown license authority, or a reachable material vulnerability without an accepted repair or containment path.
- Stop package-risk approval when the resolved graph, affected artifact, scanner/advisory freshness, or exception owner cannot be established.

## Output Contract

- Return a dependency-risk decision: state graph delta, reachability, execution origin, license evidence, remediation, bounded exceptions, and proof limits

## Targeted References

| Path | Type | Load when | Do not load when | Required by | Required output |
|---|---|---|---|---|---|
| [benchmarks and patterns](references/benchmarks-and-patterns.md) | benchmark-pattern | vulnerability origin license remediation or exception signals compete | one current graph and policy path resolves package risk without comparison | analysis-agent, task-agent, review-agent | option-comparison, selected-approach |
| [checklist](references/checklist.md) | decision-checklist | resolved graph delta needs reachability execution origin license remediation and exception closure | no dependency graph or package-risk acceptance changes | analysis-agent, task-agent, review-agent | checklist-result, residual-risk |
| [evidence patterns](references/evidence-patterns.md) | evidence-pattern | scanner reachability provenance license SBOM or exception claims need fresh proof | no package-risk claim is being accepted | analysis-agent, task-agent, review-agent | evidence-record, proof-limit, residual-risk |