Vulnerable Components Skill

The most common way to ship a known vulnerability is to add a package without checking whether it has one. An agent adding a dependency installs the version that satisfies the constraint and moves on. It does not check CVEs. It does not check whether the package is actively maintained. It does not check whether the license conflicts with your distribution terms.

What to Check Before Adding or Upgrading a Dependency

1. CVE check Before adding or upgrading a package, verify the specific version has no critical or high CVEs. Use: pip-audit, npm audit, snyk test, grype, or check the package's advisory page directly.

2. License compatibility Identify the license of the package being added. Flag GPL licenses in proprietary codebases — GPL has copyleft requirements that can affect distribution. MIT, Apache 2.0, and BSD are generally safe. Unknown or custom licenses require legal review.

3. Maintenance health A package with no commits in 24 months, no response to open issues, or fewer than 100 stars for a critical dependency is a risk. Flag unmaintained packages.

4. Transitive dependencies Run pip-audit, npm audit, or cargo audit against the full dependency tree, not just the direct addition. A clean package with a vulnerable transitive dependency is still vulnerable.