{ "schema": "aiblocks-page/1", "id": "weekly-dependency-and-security-sweep", "type": "agent", "name": "Project secrets and package risk review", "summary": "Review exposed secrets and package risks. Compare earlier findings and get a cautious upgrade order with skipped checks named.", "headline": "Project secrets and package risk review", "subhead": "Share the project, package files, lock files and any earlier findings. It checks possible secret exposure first, reviews package risks and selects deeper checks for relevant changes. You get source-backed issues and proposed upgrades. Missing versions limit coverage; no advisory is not proof of safety, and keys or packages stay unchanged without approval.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-10-28", "first_published": "2026-10-21", "inputs": [ { "type": "codebase", "required": true, "label": "Codebase", "what": "a project's code, in a folder or repo the AI can open" }, { "type": "deploy_url", "required": false, "label": "Deploy url", "what": "a live link to the app, and how it was put online" }, { "type": "incident_record", "required": false, "label": "Incident record", "what": "the record of an outage or incident: the timeline, what was affected, the alerts and who did what" } ], "outputs": [ { "type": "security_report", "required": true, "label": "Security report", "what": "the risks found in the code, ranked, each with a fix" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "Your project folder with its package files and lock files", "A link to a live site you own (optional)", "The name of any breach or package warning you heard about (optional)", "Findings you have decided to accept, and why (optional)" ], "you_get": [ "New, still open and fixed findings since last week, by severity", "Anything urgent at the top, such as a live key to replace now", "A safe order to upgrade packages", "A list of accepted risks that are due for another look" ], "use_when": [ "You ship software and want the same security checks every week.", "You heard of a package breach and want to know if you are hit.", "You want to know what changed since the last scan, not another long list." ], "skip_when": [ "You want a one-off deep review of a system that holds money, health or personal data: hire a qualified security professional.", "You want to scan a site, server or account you do not own: don't. Ask the owner to run it or to give written permission.", "You have no package files or code to give it: start with a plain check of your accounts and passwords, or ask a developer to set up the project files first." ], "output_sample": { "input": [ "Your project folder with its package files and lock files", "A link to a live site you own (optional)", "The name of a breach or package warning you heard about (optional)", "Findings you have decided to accept, and why (optional)" ], "prerequisites": [ "An AI that can read your project files, such as Claude Code", "Last week's saved list, if this is not your first sweep (the agent keeps it in a sweep folder)" ], "output": [ { "name": "This week", "contains": "One line with counts of new, still open and fixed findings, split by severity." }, { "name": "Do first", "contains": "Anything urgent, such as a live key to replace now, or a note that nothing is urgent." }, { "name": "New findings", "contains": "Each new finding with its package or file, severity, fix and risk of breaking things." }, { "name": "Still open", "contains": "Findings from earlier weeks, with how many weeks each has been open." }, { "name": "Upgrade order", "contains": "A safe order to upgrade packages, grouped so related upgrades go together." }, { "name": "Accepted risks due for review", "contains": "Risks you chose to accept that are old enough to confirm again." }, { "name": "Skipped and missing", "contains": "Checks that were skipped and why, then every MISSING line in one list." } ] }, "output_shape": "THIS WEEK\n new | still open | fixed | by severity: \n\nDO FIRST\n \n\nNEW FINDINGS\n 1. | | fix: | risk of breaking: \n\nSTILL OPEN\n | open for weeks\n\nUPGRADE ORDER\n \n\nACCEPTED RISKS DUE FOR REVIEW\n | accepted \n\nSKIPPED AND MISSING\n | MISSING: ", "how_to_use": [ "Start a chat with the agent. In Claude Code, add it as a skill or save it in .claude/agents, then ask it to run this week's sweep.", "Give it the project folder. Add a live site link only if you own the site.", "Read the Do first section. If it says to replace a key, do that before anything else.", "Approve the upgrades you want. It makes only those, on a branch, and runs your tests.", "Run it again next week. It compares with the saved list. The agent does not start itself. You set up a Monday reminder or scheduled task in your AI app. GitHub access is only needed for the build workflow check and upgrade branches.", "Next, if it finds new high or critical findings, test each group of upgrades on its own branch before you merge." ], "checks": [ "Each finding is marked new, still open, fixed or accepted.", "A possible live key is at the top with the steps in order.", "Nothing was upgraded, rotated or changed without your yes.", "Only code and sites you own were checked.", "The saved list was updated for next week." ], "steps": [ { "position": 1, "id": "secrets-hygiene-checker", "name": "Secret leak checker", "summary": "Find likely leaked credentials without copying their values into reports, then get a safe triage plan.", "url": "https://useaiblocks.com/skills/secrets-hygiene-checker" }, { "position": 2, "id": "security-incident-triager", "name": "Security incident response planner", "summary": "Use security alert details to sort threats, rate harm, plan who to call, and list needed evidence.", "url": "https://useaiblocks.com/skills/security-incident-triager" }, { "position": 3, "id": "dependency-risk-scanner", "name": "Dependency security and licence scanner", "summary": "Share authorised project files and a licence policy. Check package versions against public advisories and get risk flags, a package list and fix options.", "url": "https://useaiblocks.com/skills/dependency-risk-scanner" }, { "position": 4, "id": "advisory-exposure-checker", "name": "Security advisory exposure checker", "summary": "Name a breach or package advisory. Get a read-only check of your machine and projects, saved as a report.", "url": "https://useaiblocks.com/skills/advisory-exposure-checker" }, { "position": 5, "id": "github-actions-attack-finder", "name": "GitHub Actions security reviewer", "summary": "Share workflow files. Get potential attack paths, evidence and confidence for review.", "url": "https://useaiblocks.com/skills/github-actions-attack-finder" }, { "position": 6, "id": "exposed-secrets-finder", "name": "Exposed secrets finder", "summary": "Share a site you own. Get a report of keys and private files visitors can read, with fixes.", "url": "https://useaiblocks.com/skills/exposed-secrets-finder" }, { "position": 7, "id": "open-source-license-checker", "name": "Open-source license checker", "summary": "Share exact dependencies, license files and how you distribute the project. Map duties, possible conflicts and issues for legal review.", "url": "https://useaiblocks.com/skills/open-source-license-checker" }, { "position": 8, "id": "dependency-risk-auditor", "name": "Offline dependency risk reviewer", "summary": "Share package lists and lock files. Get an offline risk report, licence flags and an upgrade plan for further checks.", "url": "https://useaiblocks.com/skills/dependency-risk-auditor" } ], "next": [ { "name": "AI agent attack tester", "url": "https://useaiblocks.com/skills/ai-agent-attack-tester", "why": "AI agent attack tester" }, { "name": "Prompt injection defender", "url": "https://useaiblocks.com/skills/prompt-injection-defender", "why": "Prompt injection defender" } ], "source": null, "credits": [], "files": [], "links": { "page": "https://useaiblocks.com/agents/weekly-dependency-and-security-sweep", "markdown": "https://useaiblocks.com/agents/weekly-dependency-and-security-sweep.md", "json": "https://useaiblocks.com/agents/weekly-dependency-and-security-sweep.json", "instructions": "https://useaiblocks.com/skills/weekly-dependency-and-security-sweep/SKILL.md", "api_item": "https://useaiblocks.com/api/v1/items/weekly-dependency-and-security-sweep", "api_document": "https://useaiblocks.com/api/v1/documents/agent/weekly-dependency-and-security-sweep", "mcp": "https://useaiblocks.com/mcp" } }