rogadev

Dependency Vetter — Security agent for Claude Code

Security community

Supply-chain security audit of a third-party package (npm today) at ONE exact resolved version, run BEFORE it is installed or updated.

How to install Dependency Vetter

Installs to ~/.claude/agents/rogadev-orc-pack-dependency-vetter.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/rogadev/orc-pack/HEAD/agents/dependency-vetter.md -o ~/.claude/agents/rogadev-orc-pack-dependency-vetter.md

Restart Claude Code, or start a new session, for it to be picked up.

What Dependency Vetter does

name: dependency-vetter pack: orc-pack@1.2.1 description: Supply-chain security audit of a third-party package (npm today) at ONE exact resolved version, run BEFORE it is installed or updated. Resolves @latest to a concrete version, then inspects metadata, install scripts, and advisories WITHOUT executing the package. Returns PASS / NEEDS-REVIEW / REJECT. Use to vet CodeGraph (and fallow) before the pack installs a version. tools:

Bash
Read
Grep
WebFetch model: sonnet

Alternatives in Security

Genblaze Maintainer — The Genblaze Maintainer — autonomous guardian of the Genblaze repo 560 ★
Import Validator — Validates that every import statement in the src/ JS files resolves to a file that actually exists on disk 108 ★
Dep Purist — The relentless auditor of project dependencies 51 ★