From claude-plugin-snyk
Helps choose secure, healthy open-source packages by evaluating vulnerability status, maintenance health, popularity, community, and security posture. Use this skill when: - Agent needs to import a new dependency - User asks "which package should I use for X?" - User wants to compare packages (A vs B) - User asks "is this package safe?" - User asks for a "secure alternative" to a package - User mentions "dependency health", "package chooser", or "package security"
How this skill is triggered — by the user, by Claude, or both
Slash command
/claude-plugin-snyk:secure-dependency-health-checkThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Help developers and AI agents make informed decisions when selecting open-source packages by evaluating security health, vulnerability history, popularity, community, and maintenance status.
Help developers and AI agents make informed decisions when selecting open-source packages by evaluating security health, vulnerability history, popularity, community, and maintenance status.
Core Principle: Choose dependencies wisely to minimize supply chain risk.
When asked to recommend a package:
snyk_package_health_check on each candidateGoal: Clarify what the user needs before recommending packages.
If user provided candidates:
If user needs suggestions:
Goal: Evaluate each candidate package's security posture and overall health.
For each candidate package, run snyk_package_health_check with the package name, version, and ecosystem (npm, pypi, maven, nuget, or golang). Key fields returned:
overall_rating: "Healthy" or "Review recommended" — use as the primary evaluation metricsecurity: vulnerability counts by severity (critical/high/medium/low) and a security ratingmaintenance: lifecycle status, latest release date, is_archived flag, and a maintenance rating ("Healthy", "Sustainable", or "Inactive")popularity: download counts, dependent packages/repos, and a popularity ratingcommunity: stargazers count, community file presence, and a rating ("Active" or "Sustainable")latest_version: the most recent published versionrecommendation: a human-readable summary of the overall assessmentSurface the following from the tool response for comparison:
is_archived, latest_release_published_at)Immediately disqualify packages regardless of overall rating if:
is_archived: true)latest_release_published_at)Goal: Present a clear, actionable comparison.
## Package Comparison: [Use Case]
| Criteria | Package A | Package B | Package C |
|----------|-----------|-----------|-----------|
| **Overall Rating** | Healthy | Review recommended | Healthy |
| **Security Rating** | Security issues found | Security issues found | No known security issues |
| **Critical CVEs** | 0 | 1 | 0 |
| **High CVEs** | 1 | 2 | 0 |
| **Maintenance** | Healthy | Inactive | Healthy |
| **Last Release** | 2 weeks ago | 8 months ago | 1 month ago |
| **Downloads** | 500K | 2M | 300K |
| **Popularity** | Influential project | Influential project | Influential project |
### Recommendation: **Package C**
**Reasons**:
1. "Healthy" overall rating with no known security issues
2. Healthy maintenance rating - actively maintained with recent release
3. Fewest vulnerabilities across all severity levels
**Trade-offs**:
- Fewer downloads than Package B (less battle-tested)
- Consider if specific features of Package A/B are required
**Recommended version**: Use the `latest_version` from the tool response to pin an exact version.
If no package meets the security threshold:
## Warning: No Secure Option Available
All evaluated packages have significant security concerns:
- Package A: 2 Critical CVEs (actively exploited)
- Package B: Abandoned - no updates in 3 years
- Package C: Multiple high-severity vulnerabilities with no fix available
### Alternatives:
1. **Implement in-house**: For simple functionality
2. **Fork and fix**: If one package is close but has fixable issues
3. **Wait**: If updates are expected soon
4. **Accept risk**: With documented justification and monitoring
Goal: Help the user safely add the recommended package.
Recommend running snyk_sca_scan after installation to verify the full dependency tree doesn't introduce unexpected vulnerabilities.
Advise committing lock files, enabling vulnerability notifications, and checking for security updates regularly.
npx claudepluginhub snyk/claude-plugin-snyk --plugin claude-plugin-snykProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.