{
  "slug": "dependency-risk-auditor",
  "name": "gizza-ai/dependency-risk-auditor",
  "version": "0.1.0",
  "title": "Dependency Risk Auditor — package.json & lockfile risk report — gizza.ai",
  "description": "Audit a package.json, package-lock.json, yarn.lock or pnpm-lock.yaml for wildcard versions, git/URL deps, install scripts and missing integrity hashes.",
  "tags": [
    "dependency risk auditor",
    "package.json audit",
    "lockfile audit",
    "npm supply chain",
    "wildcard version check",
    "install script check",
    "package-lock audit",
    "yarn.lock audit"
  ],
  "category": "utilities",
  "urls": {
    "page": "https://gizza.ai/tools/dependency-risk-auditor/",
    "markdown": "https://gizza.ai/tools/dependency-risk-auditor/index.md",
    "descriptor": "https://gizza.ai/tools/dependency-risk-auditor/tool.json",
    "deep_link_example": "https://gizza.ai/tools/dependency-risk-auditor/?manifest=%7B%0A%20%20%22name%22%3A%20%22demo-app%22%2C%0A%20%20%22dependencies%22%3A%20%7B%20%22axios%22%3A%20%22%2A%22%20%7D%0A%7D&lockfile=%7B%0A%20%20%22lockfileVersion%22%3A%203%2C%0A%20%20%22packages%22%3A%20%7B%20%7D%0A%7D&manifest_format=auto&strictness=standard&include_dev=true&ignore=range-prefix%2C%20third-party-registry&fail_on=high&output=text"
  },
  "cli": "gizza tool dependency-risk-auditor '{\n  \"name\": \"demo-app\",\n  \"dependencies\": { \"axios\": \"*\" }\n}'",
  "tool": {
    "description": "Audit a pasted npm package.json or lockfile for risky supply-chain patterns and return a graded PASS/FAIL report. manifest takes the file contents: a package.json, package-lock.json (lockfileVersion 1/2/3), yarn.lock (classic or Berry) or pnpm-lock.yaml; the format is auto-detected unless manifest_format is set. Manifest rules flag wildcard and `latest` specs (wildcard-version), dist-tag specs such as next/beta (dist-tag-version), pre-release specs (prerelease-version), loose caret/tilde ranges (range-prefix), git and GitHub-shorthand dependencies (git-dependency), remote tarball URLs (url-dependency) and plain-http ones (http-dependency), file:/link:/portal: paths (file-dependency), npm: aliases (alias-dependency), a package declared in both dependencies and devDependencies (duplicate-dependency), package names that shadow Node built-ins (builtin-shadow), preinstall/install/postinstall scripts (install-script), other lifecycle scripts (lifecycle-script), overrides/resolutions (forced-override) and a missing engines field (missing-engines). Lockfile rules flag missing (missing-integrity) or SHA-1 (weak-integrity) hashes, plain-http resolved URLs (insecure-resolved-url), git-resolved entries (git-resolved), non-npm registry hosts (third-party-registry), a resolved URL whose version disagrees with the entry (resolved-version-mismatch), packages that run install scripts (has-install-script) and lockfileVersion 1 (legacy-lockfile-version). Pass a package.json in manifest AND its lockfile in lockfile to also get unlocked-dependency and pin-mismatch cross-checks. strictness (lenient/standard/strict, default standard) selects the severity floor, include_dev (default true) covers devDependencies, ignore suppresses rule IDs, fail_on (high/medium/low/info/never, default high) sets the FAIL threshold, and output picks text (default), markdown or json. Each report carries a 0-100 risk score and an A-F grade. Everything is local pure compute: no registry lookups, so known-vulnerability (CVE) matching, package age, maintainer counts and package-contents scanning are out of scope. Returns the audit report as text.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "fail_on": {
          "default": "high",
          "description": "Lowest severity that makes the verdict FAIL, for CI gating: high (default), medium, low, info (any finding fails), or never (always PASS, report only). Findings already filtered out by strictness or ignore never affect the verdict.",
          "enum": [
            "high",
            "medium",
            "low",
            "info",
            "never"
          ],
          "type": "string"
        },
        "ignore": {
          "description": "Rule IDs to suppress, comma- or newline-separated. Example: \"range-prefix, third-party-registry\". Rule IDs appear in square brackets in the text report and in the rule field of the JSON report — wildcard-version, dist-tag-version, prerelease-version, range-prefix, git-dependency, url-dependency, http-dependency, file-dependency, alias-dependency, duplicate-dependency, builtin-shadow, install-script, lifecycle-script, forced-override, missing-engines, missing-integrity, weak-integrity, insecure-resolved-url, git-resolved, third-party-registry, resolved-version-mismatch, has-install-script, legacy-lockfile-version, unlocked-dependency, pin-mismatch, no-lockfile-supplied. Leave empty to report everything.",
          "type": "string"
        },
        "include_dev": {
          "default": true,
          "description": "Audit devDependencies and dev-only lockfile entries too. Set false to review only what ships to production. Default true.",
          "type": "boolean"
        },
        "lockfile": {
          "description": "Optional second file: the lockfile that goes with the package.json in manifest. Supplying both also runs the cross-checks — dependencies declared but missing from the lockfile (unlocked-dependency) and exact pins that disagree with the locked version (pin-mismatch). Leave empty to audit a single file. Maximum 2097152 bytes.",
          "type": "string"
        },
        "manifest": {
          "description": "The file to audit, pasted as text: an npm package.json, a package-lock.json, a yarn.lock (classic or Berry), or a pnpm-lock.yaml. The format is auto-detected unless manifest_format is set. Maximum 2097152 bytes.",
          "type": "string"
        },
        "manifest_format": {
          "default": "auto",
          "description": "How to parse manifest: auto (detect from the content, default), package-json, package-lock (npm lockfileVersion 1/2/3), yarn-lock (classic v1 or Berry), or pnpm-lock (pnpm-lock.yaml).",
          "enum": [
            "auto",
            "package-json",
            "package-lock",
            "yarn-lock",
            "pnpm-lock"
          ],
          "type": "string"
        },
        "output": {
          "default": "text",
          "description": "Report format: text (verdict, grade and findings grouped by severity — the default), markdown (a PR-ready findings table), or json (verdict, score, grade, per-severity summary and a findings array).",
          "enum": [
            "text",
            "markdown",
            "json"
          ],
          "type": "string"
        },
        "strictness": {
          "default": "standard",
          "description": "Which findings to report, by severity: lenient (high only — the supply-chain red flags), standard (high and medium, the default), or strict (also low and info — loose caret/tilde ranges, missing engines, Node built-in name shadowing, overrides, legacy lockfile versions).",
          "enum": [
            "lenient",
            "standard",
            "strict"
          ],
          "type": "string"
        }
      },
      "required": [
        "manifest"
      ],
      "type": "object"
    }
  }
}