# infynon-pkg

A skill and subagent that checks your dependencies for CVEs, intercepts installs across 14 package ecosystems and suggests safe versions.

- plugin · `type=plugin` · Claude Code · ★ 5
- Author: d4rkNinja
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/d4rkNinja/code-guardian
- Updated: 2026-04-23
- HTML: https://affpapa.org/en/nevibecode/plugins/infynon-pkg

## What it does

infynon-pkg belongs to the INFYNON suite for Claude. Once installed, the agent spots lock files in your project and offers a vulnerability scan backed by OSV.dev. Three skills ship with it: `package-security` fires on CVE and dependency-audit questions, `cve-triage` helps you read scan output and rank fixes, and `eagle-eye-monitor` handles ongoing monitoring with email alerts. A `pkg-guardian` subagent covers deeper analysis, migration advice and CI setup.

Everything runs on the `infynon` CLI. Without it, the skills can only tell you what to install. The CLI itself comes from `npm install -g infynon`, a shell script on Linux and macOS, or a Rust build from source. Installs go through a wrapper: `infynon pkg npm install express`, `infynon pkg uv add fastapi`, `infynon pkg cargo add serde`. For CI there are `--strict high` (exits with code 3), `--json`, `--auto-fix`, `--skip-vulnerable` and `--no-input`.

The plugin wraps your package manager rather than replacing it, so commands still land in npm, pip or cargo. Session hooks from the sibling `infynon-trace` plugin are opt-in and written to the project's `.claude/settings.json`, never to system-level settings.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-community
```
In the agent chat (not a shell):
```text
/plugin install infynon-pkg@claude-community
```

## When to use it
- scan a project's dependencies for known CVEs
- install a package without pulling in a vulnerable version
- make sense of scan results and pick what to fix first
- set up non-interactive auditing in CI
- find out why a package sits in the dependency tree

## Example prompts
- Scan this project's dependencies for vulnerabilities and flag the critical ones
- Install express safely, checking versions first
- Set up vulnerability monitoring with email alerts

## Similar
- [dependency-scan](https://affpapa.org/en/nevibecode/skills/dependency-scan.md) — skill · 355 installs
- [dependencies-audit](https://affpapa.org/en/nevibecode/skills/dependencies-audit.md) — skill · 1900 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [dependency-upgrade](https://affpapa.org/en/nevibecode/skills/secondsky-dependency-upgrade.md) — skill · 404 installs
- [Security Intel MCP](https://affpapa.org/en/nevibecode/mcp/security-intel-mcp.md) — MCP server
- [dependency-checker](https://affpapa.org/en/nevibecode/hooks/dependency-checker.md) — hook · 2314 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md