Dependency and Supply-Chain Scanning for Agents

Guard against the dependencies your agent adds: vulnerability scanning, hallucinated-package detection, and gated installs.

0 runs0 forks0

Chain

Inputs

Step 1

flow-dependency-supply-chain-scanning-agents-1-intercept-dependency-additions

Step 2

flow-dependency-supply-chain-scanning-agents-2-verify-existence-and-reputation

Step 3

flow-dependency-supply-chain-scanning-agents-3-scan-for-vulnerabilities

Step 4

flow-dependency-supply-chain-scanning-agents-4-gate-review-and-enforce-lockfile-

Final output

No inputs required — hit Run to stream each step in order.

Each step streams from its model and feeds the next. BYOK — you pay your provider directly. Add a key in Settings if a step needs one.

Step 1 · Every new dependency is a trust decision - catch it at the source.

flow-dependency-supply-chain-scanning-agents-1-intercept-dependency-additions

Claude Sonnet 4.6→ {{step_1}}

Awaiting upstream steps…

Step 2 · The defining AI supply-chain risk: packages that should not be trusted or do not exist.

flow-dependency-supply-chain-scanning-agents-2-verify-existence-and-reputation

Claude Sonnet 4.6→ {{step_2}}

Awaiting upstream steps…

Step 3 · Real packages can still carry known holes.

flow-dependency-supply-chain-scanning-agents-3-scan-for-vulnerabilities

Claude Sonnet 4.6→ {{step_3}}

Awaiting upstream steps…

Step 4 · Reviewed set in, reviewed set installed - recorded.

flow-dependency-supply-chain-scanning-agents-4-gate-review-and-enforce-lockfile-

Claude Sonnet 4.6→ {{step_4}}

Awaiting upstream steps…

Guard against the dependencies your agent adds: vulnerability scanning, hallucinated-package detection, and gated installs.

1
Every new dependency is a trust decision - catch it at the source.
Runs flow-dependency-supply-chain-scanning-agents-1-intercept-dependency-additions on Claude Sonnet 4.6
2
The defining AI supply-chain risk: packages that should not be trusted or do not exist.
Runs flow-dependency-supply-chain-scanning-agents-2-verify-existence-and-reputation on Claude Sonnet 4.6
3
Real packages can still carry known holes.
Runs flow-dependency-supply-chain-scanning-agents-3-scan-for-vulnerabilities on Claude Sonnet 4.6
4
Reviewed set in, reviewed set installed - recorded.
Runs flow-dependency-supply-chain-scanning-agents-4-gate-review-and-enforce-lockfile- on Claude Sonnet 4.6

•Recurring tasks you currently copy-paste between tools.
•When a single prompt isn't enough — you need a chain where output(n) feeds prompt(n+1).
•Fork and adapt if your inputs differ materially from the author's use case.

Claude Sonnet 4.6