DepGuard is a comprehensive security skill for auditing dependencies, scanning for vulnerabilities, and ensuring license compliance across multiple programming languages.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install depguard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install depguard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is DepGuard?
DepGuard is a professional-grade security and compliance tool designed to safeguard your software supply chain. It integrates seamlessly with native package managers to identify known vulnerabilities, outdated packages, and problematic licenses. By leveraging this Openclaw Skills extension, developers can automate the critical task of dependency management, ensuring that every library used in a project meets security and legal standards.
Whether you are managing a small repository or a complex monorepo, DepGuard provides the visibility needed to maintain a healthy codebase. It supports a wide range of ecosystems including npm, pip, cargo, and go, offering features that scale from simple one-shot scans to continuous monitoring and automated vulnerability fixing.
DepGuard Use Cases
- Scanning local project directories for known security vulnerabilities in third-party packages.
- Auditing dependency licenses to ensure they align with corporate legal policies.
- Generating formatted markdown security reports for stakeholders and compliance auditors.
- Blocking insecure code at the commit level by integrating security scans into git hooks.
- Producing detailed Software Bill of Materials (SBOM) for enterprise transparency.
How DepGuard Works
- The skill automatically detects the project's package manager by looking for specific lockfiles like package-lock.json, yarn.lock, or Cargo.lock.
- It executes native audit commands such as npm audit or govulncheck to retrieve the latest vulnerability data from security databases.
- The tool parses dependency manifests to extract license information and categorize them by risk level (e.g., permissive vs. copyleft).
- Results are processed and formatted into a comprehensive report that highlights critical risks and actionable remediation steps.
- For users with advanced configurations, it monitors for lockfile changes to trigger automated re-scans or blocks commits containing high-severity vulnerabilities.
DepGuard Setup
To enable DepGuard within your Openclaw Skills environment, ensure you have git and bash installed. For git hook integration, install the lefthook manager:
brew install lefthook
Configure the skill in your openclaw.json file by adding your license key and defining your security thresholds:
{
"skills": {
"entries": {
"depguard": {
"enabled": true,
"apiKey": "YOUR_LICENSE_KEY",
"config": {
"severityThreshold": "high"
}
}
}
}
}
DepGuard Data Schema & Taxonomy
DepGuard organizes security and compliance data into a structured format for clear reporting. It maps dependencies against a rigorous metadata taxonomy:
| Field | Description |
|---|---|
| Severity | Categorizes vulnerabilities as Low, Moderate, High, or Critical |
| License Type | Maps licenses to categories like Permissive, Copyleft, or Proprietary |
| Lockfile Mapping | Tracks vulnerabilities back to specific manifest files |
| SBOM Export | Supports industry-standard formats including CycloneDX and SPDX |
The skill supports scanning for npm, yarn, pnpm, pip, cargo, go, composer, bundler, maven, and gradle ecosystems.
DepGuard Advanced Features
- Continuous monitoring that watches for any lockfile changes to provide real-time security alerts.
- Proactive git hook integration via lefthook to prevent vulnerable dependencies from entering the version control system.
- Automated vulnerability remediation that attempts to fix security holes by upgrading to patched package versions.
- Customizable license policies that allow developers to block specific licenses like GPL-3.0 or AGPL-3.0.
- Full support for monorepos and workspaces, allowing for comprehensive scans across multiple packages in a single command.
SKILL.md
Loading
Related Openclaw Skills
Claude Local Bridge
Access local repositories from Claude on your mobile device through a secure, approval-gated MCP bridge.
Sanctuary
Sanctuary provides AI agents with permanent, encrypted memory and provable cryptographic identity continuity that survives platform migrations or resets.
Unipile LinkedIn
A comprehensive CLI integration for the Unipile API that enables automated LinkedIn messaging, profile management, and content engagement.
Lottery Checker
A high-performance Python utility for batch-checking China Sports Lottery Super Lotto (DLT) winning numbers and generating detailed prize reports.
Telegram Photo Dispatcher
A Python-powered utility for programmatically sending image files and screenshots to Telegram chats using the Bot API.
SEC Watcher
A specialized tool for monitoring and summarizing real-time SEC EDGAR filings for leading AI and technology companies.
METADATA
Featured*
