Hivemind Sign in
Tools

Dependency audit

Tool Code @dip497 0 installs

The repository's lockfiles checked against the public OSV database: vulnerable packages by severity, with the advisory and the version that fixes it.

hive plugins install @dip497/dependency-audit

Run it in a terminal, or find it in Hivemind under Settings ▸ Plugins.

OverviewInstallPermissionsVersions

Dependency audit

The repository's lockfiles checked against OSV, the public database of known vulnerabilities: each vulnerable package with its worst severity, every advisory against it (id, summary, CVE) and the version that fixes it. Filter by severity; open an advisory on osv.dev; "Ask an agent to upgrade" starts one in the tile's frame with the list (you read the prompt before it is sent).

It reads Cargo.lock, package-lock.json, yarn.lock, pnpm-lock.yaml, uv.lock, poetry.lock and requirements.txt (only == pins) anywhere git tracks them, outside node_modules. All packages go in batches of up to 1000 to POST /v1/querybatch, then each advisory found is read once from GET /v1/vulns/<id>; its severity is the database's own word, or the band of its CVSS 3 score. Answers are kept for ten minutes; "Check again" asks afresh.

hive plugins install @dip497/dependency-audit
hive plugins enable @dip497/dependency-audit
hive ctl open-tool @dip497/dependency-audit/audit

An agent asks it, while its tile is open:

hive ctl plugin call @dip497/dependency-audit audit      # every finding
hive ctl plugin call @dip497/dependency-audit packages   # packages per lockfile

It asks for two permissions: start agents (workspace:spawn) and tell an agent something (workspace:prompt). It needs git and curl, and sends package names and versions to api.osv.dev.

How it was made

Built by a coding agent (Claude) from the tool-plugin contract (the brief hive plugins new tool writes, and the tool plugin guide). It uses host.run of git ls-files, cat and curl (the batch query's body on stdin), host.openUrl for an advisory, and hm.commands.spawnAgent with the permissions above. The parsing is in lib.js, tested on real lockfile and OSV output.

A tool arrives switched off. Turn it on in Settings ▸ Plugins, or with hive plugins enable @dip497/dependency-audit, if you trust who wrote it.

Files

From dip497/hivemind-plugins at fb488a4. Hivemind checks each file's checksum as it downloads, and stops if one changed.

  • hivemind-tool.jsoneac580abc7de
  • icon.svge031847386d9
  • index.js27176ec3edf9
  • lib.js8517f1ecf2b0
  • README.mdc91fc0b22983
hivemind-tool.json 
{
  "id": "@dip497/dependency-audit",
  "name": "Dependency audit",
  "version": "1.0.1",
  "apiVersion": 1,
  "minAppVersion": "2026.10.3",
  "category": "code",
  "description": "The repository's lockfiles checked against the public OSV database: vulnerable packages by severity, with the advisory and the version that fixes it.",
  "entry": "index.js",
  "permissions": [
    "workspace:spawn",
    "workspace:prompt"
  ],
  "commands": [
    {
      "name": "audit",
      "description": "Every vulnerable package: name, version, ecosystem, lockfiles, advisory id, summary, severity and the version that fixes it. Waits up to 25 seconds for a check still running."
    },
    {
      "name": "packages",
      "description": "Each lockfile found, its ecosystem and how many pinned packages it holds."
    }
  ],
  "tools": [
    {
      "key": "audit",
      "label": "Dependency audit",
      "description": "Known vulnerabilities in the repository's dependencies.",
      "tileKind": "dependency-audit",
      "size": {
        "width": 1000,
        "height": 700
      },
      "needsRepo": true,
      "singleton": true,
      "glyph": "⛨",
      "icon": "icon.svg"
    }
  ]
}

Hivemind shows you this list and asks before it installs.

  • Runs inside Hivemind, with the app's access to your files and network, once you switch it on
  • Start agents in your workspace
  • Tell an agent something (you send or cancel each one)
VersionCommitListed
1.0.1 fb488a4 October 28, 2026

Needs Hivemind 2026.10.3 or newer.

HiveHub keeps the version listed last. The ones before it are in the repository's history.

Something wrong with it? Report it.