/dependency-risk-review - Dependency Risk Review Command for Claude Code

The /dependency-risk-review command assesses supply-chain posture — how healthy and trustworthy your dependencies are to depend on — using OpenSSF Scorecard health checks, with OSV advisories as a secondary signal. It complements CVE scanners (which answer "is there a known vulnerability?") by answering "is this dependency well-maintained, reviewed, and safe to trust?".

Usage

/dependency-risk-review [package]

• With a package name: review that single dependency.
• Without an argument: review the project's high-impact direct dependencies.

What it does

When you invoke this command, follow these steps and avoid disclosing private project metadata:

1. Pick the targets. Read direct dependencies from package.json, a lockfile, requirements.txt, go.mod, or Cargo.toml. Prioritize dependencies that are widely imported, run at build/CI time, or have many transitive children.
2. Screen for private metadata. Before any external lookup, identify private or internal package names, private registry hosts, non-public repository URLs, and scoped packages that appear organization-private. Exclude those dependencies from public API calls unless the user explicitly confirms that sharing their names, versions, and repository identifiers with Scorecard and OSV is acceptable.
3. Resolve source repos. Map each remaining public dependency to its source repository (for example via the registry metadata's repository field).
4. Look up Scorecard. Query the public API https://api.securityscorecards.dev/projects/github.com/<owner>/<repo> only for public repos. If a repo is not in the dataset, optionally run scorecard --repo=github.com/<owner>/<repo> locally only after confirming the repo identifier is public or approved to share.
5. Read the risk-bearing checks. Surface low scores for Maintained, Dangerous-Workflow, Pinned-Dependencies, Signed-Releases, Token-Permissions, Code-Review, Branch-Protection, and Vulnerabilities.
6. Cross-reference advisories. Query OSV (https://api.osv.dev/v1/query) for known advisories affecting the installed version of each public or user-approved dependency.
7. Rank and recommend. Rank dependencies by combined risk and, for each high-risk one, recommend a concrete action: pin to a hash, update, replace with a healthier alternative, vendor, or add monitoring.

Output format

• Dependency: name + version + source repo, or "skipped/private" for dependencies excluded from external lookups.
• Scorecard: aggregate score and the lowest risk-bearing checks.
• Advisories: any OSV matches for the installed version.
• Risk: high / medium / low with the driving signal.
• Action: the recommended mitigation.

Requirements

• Network access to the public OpenSSF Scorecard API (api.securityscorecards.dev) and OSV API (api.osv.dev).
• curl or an equivalent HTTP client.
• Optional: the scorecard CLI and a GitHub token to score repositories not already in the public dataset.

Safety notes

The command only queries public APIs for dependencies confirmed to be public, or for private/internal dependency metadata that the user explicitly approves sharing. It changes nothing in your project or dependencies. The optional scorecard CLI performs read-only analysis. The review is advisory: it ranks risk and recommends actions but does not pin, update, remove, or vendor anything itself.

Privacy notes

Dependency package names, installed versions, scoped package names, and source repository identifiers may be sensitive in proprietary projects. Do not send private/internal packages or private repository identifiers to the public Scorecard or OSV APIs unless the user explicitly confirms that sharing that metadata is acceptable. Source code, full lockfile contents, and credentials are never sent; API responses (numeric scores and advisory text) enter the model context to explain the ranking. Nothing is written to disk beyond output you redirect.

Source and references

• OpenSSF Scorecard: https://securityscorecards.dev/
• Scorecard checks reference: https://github.com/ossf/scorecard/blob/main/docs/checks.md
• OSV (Open Source Vulnerabilities): https://osv.dev/

• Source repositorygithub.com 2026-07-18T19:14:44+00:00
• Documentationsecurityscorecards.dev
• Submitted by techforgeworks2026-06-04