2.9 KiB
| description | applyTo | mode | version |
|---|---|---|---|
| Sub-instructions of "dependency-risk-base-level.instructions.md" focused on per-repository guidance or tools for "Should I use" questions. | ** | agent | 0.1.01 |
Dependency Risk Repository Level Instructions
Instructions
The following are instructions that reflect policies that must be followed that are specific to this repository. They build off of the instructions found in the ./dependency-risk-base-level.instructions.md and override any instructions in that file.
MCPs or APIs
No additional instructions for MCPs or APIs at this time.
Formatting and Styling Guidelines for Dependency Risk Report
-
Use section headers in bold (e.g., Indicators of risk: POSSIBLY ABANDONED).
-
For each risk indicator, use:
- ✅ for "No" (no risk triggered)
- ⚠️ for "Yes" (yes risk triggered)
- ❌ for "Yes" (yes risk triggered AND meets one of the criteria mentioned below for when to use ❌)
- ❔ for "Not found" (information not available)
-
Highlight any triggered risks in bold.
-
Use bullet points for each item.
-
At the end, include a summary table or list of triggered risks.
-
Keep links on their own lines for clarity. If very relevant, provide link to a risk source when mentioning that risk.
-
Example 1:
**Indicators of risk: POSSIBLY ABANDONED** - ✅ The package itself is deprecated: No - ✅ The source repository is archived: No - ❌ The latest version of package was published more than 2 years ago: Yes (2020-08-19) -
Example 2:
Indicators of risk: NOT ENOUGH EYEBALLS TO SPOT PROBLEMS - ⚠️ Number of dependent repositories is <500: Yes (29) - ✅ Number of package downloads <10,000: No (24,221 last month)
“Strictly follow the symbol usage rules below. Do not use ❌ for ‘No’ responses.
Any addition instructions based on section of the report
Indicators of that risk that project is POSSIBLY ABANDONED?
when to use ❌
- Do allow usage of packages that:
- Yes: depreciated : Signify this with a ❌ if it is detected.
- Yes: archived : Signify this with a ❌ if it is detected.
- Yes: the latest version is more than X number of years old. Signify this with a ❌ if it is detected.
Indicators of risk that there are NOT ENOUGH EYEBALLS TO SPOT PROBLEMS?
when to use ❌
- Do not suggest or allow usage of packages that:
- Number of package downloads <1000 Signify this with a ❌ if it is detected.
Indicators of risk that CONTRIBUTION COULD STOP SUDDENLY?
Indicators of risk of: SECURITY VULNERABILITIES
- Use ⚠️ if vulnerabilities detected.
- Do not suggest usage of package's latest version when that version has any security vulnerabilities reported against it. Suggest different package instead. Give date of last update.