Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Update URLs to free Cloudflare Pages hosting (depguard.pages.dev)
What This Skill Does
DepGuard scans project dependencies for known vulnerabilities, license violations, and outdated packages using native package manager audit tools. It supports 10 package managers including npm, pip, cargo, and Go. Free one-shot scans require no configuration; paid tiers add git hooks, continuous monitoring, SBOM generation, and compliance reporting.
It wraps native audit tools for 10 package managers into one command, adding license analysis and offline risk scoring without sending dependency data to an external server.
When to use it
- Checking npm packages for CVEs before a production deploy
- Auditing open source licenses before shipping a commercial product
- Blocking GPL dependencies from entering a proprietary codebase
- Generating an SBOM for a security audit or procurement requirement
- Auto-fixing vulnerable package versions across a monorepo
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Scan my dependencies for vulnerabilities
- 1Detects the package manager by checking for lockfiles in the project directory
- 2Runs the native audit command for the detected manager (e.g., npm audit)
- 3Parses dependency manifests to extract license information
- 4Scores findings by severity and flags problematic or unknown licenses
- 5Outputs a formatted security report with package names, CVE references, and severity levels
Markdown report listing vulnerable packages with CVE details, severity ratings, and any flagged or unknown licenses
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.