Hire an AI project secrets and package risk review

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• New, still open and fixed findings since last week, by severity
• Anything urgent at the top, such as a live key to replace now
• A safe order to upgrade packages
• A list of accepted risks that are due for another look

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Reporting every low finding as urgent.
• Calling a package safe because no advisory has been published yet.
• Running a check against something the person does not own.
• Upgrading everything at once. Group related upgrades and test each group.
• Printing a secret in full. Show the first and last few characters only.
• Long lists of generic issues with no evidence they apply.

What a good result looks like

An example, not your task: You ship software and want the same security checks every week.

• This week. One line with counts of new, still open and fixed findings, split by severity.
• Do first. Anything urgent, such as a live key to replace now, or a note that nothing is urgent.
• New findings. Each new finding with its package or file, severity, fix and risk of breaking things.
• Still open. Findings from earlier weeks, with how many weeks each has been open.
• Upgrade order. A safe order to upgrade packages, grouped so related upgrades go together.
• Accepted risks due for review. Risks you chose to accept that are old enough to confirm again.

How the work is checked

• Every finding is marked new, still open, fixed or accepted.
• A possible live key is at the top, with the order of steps.
• No fix was made that the person did not approve.
• Only things the person owns were checked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Read its memory. Opens last week's findings and the risks you decided to accept.
• Check for exposed secrets. Looks for leaked keys first. If one looks live, it triages the incident before anything else.
• Scan the packages. Finds known weak spots and sorts each as new, still open or fixed.
• Choose the deeper checks. Checks a named advisory, changed build workflows, a live site or new packages, only when that applies.
• Order the upgrades. For new high or critical findings, works out a safe order to upgrade.
• Apply the memory rules. Moves long-open serious findings to the top, flags accepted risks that are due for review, and saves this week's list.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id weekly-dependency-and-security-sweep only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/weekly-dependency-and-security-sweep/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your project folder with its package files and lock files
• A link to a live site you own (optional)
• The name of any breach or package warning you heard about (optional)
• Findings you have decided to accept, and why (optional)

Helpful context (optional)

• Your package files and lock files
• A note of anything you changed in build workflows

Tools and access

• Claude Code: It can read your lock files, keep the sweep folder and run on a schedule.
• GitHub: It reads your build workflows and, with your yes, opens upgrade branches.

Functions and deliverables

• Project secrets and package risk review: Review exposed secrets and package risks. Compare earlier findings and get a cautious upgrade order with skipped checks named.
  • New, still open and fixed findings since last week, by severity
  • Anything urgent at the top, such as a live key to replace now
  • A safe order to upgrade packages
  • A list of accepted risks that are due for another look
• Dependency security and licence scanner: Share authorised project files and a licence policy. Check package versions against public advisories and get risk flags, a package list and fix options.
  • Vulnerability report by severity
  • Licence compliance flags
  • Software bill of materials
  • Minimum upgrades to fix problems
  Source: Burhan Sebin.
• Secret leak checker: Find likely leaked credentials without copying their values into reports, then get a safe triage plan.
  • A list of likely leaked secrets ranked by severity
  • Rotation and cleanup steps
  • A tidied env file layout
  • A pre-merge secret scan setup
  Source: Alireza Rezvani.
• Security incident response planner: Use security alert details to sort threats, rate harm, plan who to call, and list needed evidence.
  • An incident type and severity score
  • A false positive check
  • An escalation path
  • An evidence preservation list
  • Next steps
  Source: Alireza Rezvani.
• Security advisory exposure checker: Name a breach or package advisory. Get a read-only check of your machine and projects, saved as a report.
  • A list of checks run
  • What was found on your machine
  • A clear verdict
  • A saved report
  • Follow-up steps for you
  Source: sickn33.
• GitHub Actions security reviewer: Share workflow files. Get potential attack paths, evidence and confidence for review.
  • Findings with a full attack path, listed with severity and the workflow line
  • The steps an attacker would take, and what they would gain
  • A fix for each proven finding
  • A separate list of unproven items to check by hand
  • A list of workflows that were checked and cleared
  Source: sickn33.
• Exposed secrets finder: Share a site you own. Get a report of keys and private files visitors can read, with fixes.
  • List of exposed secrets and files
  • Where each one was found
  • Risk level per finding
  • Fix steps, including rotating keys
  Source: sickn33.
• Open-source license checker: Share exact dependencies, license files and how you distribute the project. Map duties, possible conflicts and issues for legal review.
  • A license inventory table
  • Compatibility analysis
  • Copyleft risk flags with severity
  • Required notices and suggested fixes
  Source: Burhan Sebin.
• Offline dependency risk reviewer: Share package lists and lock files. Get an offline risk report, licence flags and an upgrade plan for further checks.
  • Vulnerability scan results
  • Licence conflict list
  • Upgrade plan in safe order
  • Re-scan to confirm fixes
  Source: Alireza Rezvani.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You ship software and want the same security checks every week.
• You heard of a package breach and want to know if you are hit.
• You want to know what changed since the last scan, not another long list.

Limits to check before starting

• You want a one-off deep review of a system that holds money, health or personal data: hire a qualified security professional.
• You want to scan a site, server or account you do not own: don't. Ask the owner to run it or to give written permission.
• You have no package files or code to give it: start with a plain check of your accounts and passwords, or ask a developer to set up the project files first.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Start a chat with the agent. In Claude Code, add it as a skill or save it in .claude/agents, then ask it to run this week's sweep.
• Give it the project folder. Add a live site link only if you own the site.
• Read the Do first section. If it says to replace a key, do that before anything else.
• Approve the upgrades you want. It makes only those, on a branch, and runs your tests.
• Run it again next week. It compares with the saved list. The agent does not start itself. You set up a Monday reminder or scheduled task in your AI app. GitHub access is only needed for the build workflow check and upgrade branches.
• Next, if it finds new high or critical findings, test each group of upgrades on its own branch before you merge.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/weekly-dependency-and-security-sweep for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.