Safety instructions preventing agents from installing hallucinated, typosquatted, or CVE-vulnerable npm/PyPI dependencies without automated verification.
Third-Party Package & Dependency Vulnerability Guardrail for Agents
Objective
Prevent LLM agents from introducing supply-chain vulnerabilities, installing non-existent/typosquatted packages, or pulling dependencies with known critical CVEs.
Agent Guardrail Rules
1. Audit Registry Presence Before Install: Check npm view <package> or pip show <package> to confirm package exists and has significant download volume (>1,000 weekly downloads).
2. Prefer Existing Project Dependencies: Before adding a new utility library (e.g. lodash, axios, date-fns), check package.json / pyproject.toml to verify if an equivalent library is already present in the workspace.
3. Run Package Vulnerability Scans:
npm audit --audit-level=high