Claude Agent

dependency-reviewer

Imported from arbiterforge/codearbiter/site/src/curated/agents/dependency-reviewer.md.

LLM Mart · 0 points · 14 0 0

Download arbiterforge-codearbiter-site_src_curated_agents_dependency-reviewer.md-44989c5.zip · 0 KB

arbiterforge/codearbiter 145 7 forks AGPL-3.0 Updated 9d ago

Part of arbiterforge/codearbiter — 238 skills

Install

skills CLI npx skills add https://github.com/arbiterForge/codeArbiter/tree/main/site/src/curated/agents/dependency-reviewer.md

Git git clone https://github.com/arbiterForge/codeArbiter.git

The skills CLI installs just this skill, for any of its supported agents. Git is the plain clone.

Files (codearbiter)

dependency-reviewer.md 1.1 KB

---
entity: agents/dependency-reviewer
related: [commands/add-dep, skills/subagent-driven-development]
---

## Role

Read-only reviewer of third-party dependencies and container base images: checks license, provenance,
maintenance signal, known CVEs, and supply-chain posture before any install runs. It never installs
anything itself. `/ca:add-dep` dispatches it as the sole gate before a new dependency is added;
`subagent-driven-development` dispatches it when an author agent's diff touches a manifest or lock
file.

## Why this model tier

Ships `model: sonnet`. Judging license compatibility, provenance, and supply-chain risk from an
external registry (it holds `WebFetch`) is closer to research-grade reasoning than a fixed-pattern
scan, which is why it sits above the haiku-tier checks.

## What it emits

A per-check verdict (license, provenance, maintenance signal, CVEs, supply-chain posture, each
PASS/BLOCK/FLAG) plus CRITICAL–LOW findings with the package name and remediation. Blocks the install
on a denied license, an unapproved source, or a known CRITICAL CVE with no documented justification.