Dependency & Package Review

Perform a coverage-complete, evidence-backed review of the repository's software supply chain. Treat the result as a gate: never infer a clean result from partial discovery, an unavailable scanner, or unresolved critical evidence.

Preserve the safety and authorization boundary

• Follow the user request and every applicable AGENTS.md before reviewing anything.
• Record git status --short before the review and again before handoff. Preserve existing user work.
• Keep an explicit review request read-only. Do not edit manifests, lockfiles, source, configuration, or reports unless separately authorized.
• For an already-authorized add, install, upgrade, replacement, or removal, complete the preflight gate first. Continue only when the gate permits it, use non-interactive resolver options that disable lifecycle scripts where available, then inventory and rescan the complete post-resolution graph.
• Treat authorization to change a dependency as authorization for that scoped change, not permission to execute arbitrary dependency build or lifecycle code. Ask separately before executing untrusted code, and require suitable isolation.
• Do not install scanners, package managers, runtimes, or helper packages during the review. Use only already-installed tools whose relevant mode is demonstrably non-mutating and non-executing.
• Do not run builds, imports, package lifecycle scripts, post-install hooks, Gradle or Maven plugins, Rust build.rs, setup code, container entrypoints, or reachability modes that compile or execute dependencies without explicit authorization and isolation. OSV-Scanner Rust call analysis executes dependency build scripts and is unsafe by default.
• Never expose credentials, tokens, private registry URLs, or private dependency coordinates. Automatically transmit only public package coordinates. Do not upload private manifests, lockfiles, SBOMs, source, or repository metadata without explicit authorization.
• Record every skipped action and the evidence it prevents. Critical gaps are research-gated and may force BLOCKED; they are never a clean result.

1. Establish scope and repository state