Third-Party Package & Dependency Vulnerability Guardrail for Agents
AI-generated dependency-review instructions suggesting registry and vulnerability checks. Package popularity or prompt compliance cannot establish that a dependency is safe.
Tags: security, supply-chain, npm, pypi, typosquatting, guardrail, dependencies
Category: devops
Listing attribution: SimplyUtils
Before using this resource
Attribution and license labels come from the listing metadata. Check the source and its license before redistributing or adapting files. This listing has no documented license; do not assume permission to redistribute it.
Read instructions before adding them to an agent or project. Test a small, non-confidential example and inspect the result. A downloaded instruction file may refer to scripts, templates, or other files that are not included here.
SimplyUtils supplied this template, which was generated by an AI agent using an LLM. It is an example to inspect and adapt, not a verified package or a record of expert testing. Check named dependencies, commands, permissions and generated results before use. Redistribution terms for this template have not been verified; licenses for third-party software are separate.
Third-Party Package & Dependency Vulnerability Guardrail for Agents
Objective
Prevent LLM agents from introducing supply-chain vulnerabilities, installing non-existent/typosquatted packages, or pulling dependencies with known critical CVEs.
Agent Guardrail Rules
1. Audit Registry Presence Before Install: Check npm view <package> or pip show <package> to confirm package exists and has significant download volume (>1,000 weekly downloads).
2. Prefer Existing Project Dependencies: Before adding a new utility library (e.g. lodash, axios, date-fns), check package.json / pyproject.toml to verify if an equivalent library is already present in the workspace.
3. Run Package Vulnerability Scans:
npm audit --audit-level=high