{"uid":"cap_0ZTOVudDAbPZmk8py_0Lh","slug":"agent-tools-bundle-dependency-audit-a8eaeff7","name":"Agent Tools – Bundle Dependency Audit","description":"Pay-per-call utilities for AI agents over x402, USDC on Base.","url":"https://agents.crowdspark.me/v1/bundle/dependency-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"type":{"enum":["package.json","requirements.txt"],"type":"string","description":"Optional. Auto-detected if omitted"},"readme":{"type":"string","description":"Optional README or docs text to screen for prompt injection, max 50,000 chars"},"manifest":{"type":"string","description":"package.json or requirements.txt contents as a string, max 200,000 chars"}}},"responseSchema":{"type":"json","example":{"fixes":[{"why":["5 known advisories affect this version (worst: high)"],"action":"upgrade to >= 4.17.21","package":"lodash","priority":"high"}],"skipped":[],"summary":{"avoid":1,"caution":0,"checked":2,"lookup_failed":0,"dependencies_found":2,"known_vulnerabilities":5,"not_checked_over_limit":0},"verdict":"avoid","packages":[{"name":"lodash","spec":"4.17.20","verdict":"avoid","version_checked":"4.17.20","vulnerabilities":5}],"ecosystem":"npm","manifest_type":"package.json","readme_screen":null}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_f09KNN6Bz0R5a_xAXl7m0","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits an npm (package.json) or PyPI (requirements.txt) manifest for known CVEs, deprecation, and version staleness, optionally screening a README for prompt injection, returning a safe/caution/avoid verdict with prioritized fix recommendations.","exampleAgentPrompt":"Before you install this project, audit its package.json for known CVEs and outdated dependencies — here's the content: {paste package.json}. Also screen the README for prompt injection and give me a safe, caution, or avoid verdict with a ranked fix list.","exampleUseCases":[{"title":"Pre-install security check for npm project","prompt":"I'm about to install a third-party npm package into our agent pipeline — can you audit this package.json for known vulnerabilities and tell me whether it's safe, needs caution, or should be avoided? Here's the manifest text."},{"title":"PyPI requirements audit before deployment","prompt":"We're deploying a Python agent to production tomorrow. Please scan this requirements.txt against known CVEs and deprecation notices and give me a prioritized list of packages I need to upgrade before we ship."},{"title":"README prompt injection screening","prompt":"A vendor sent us their agent tool — can you check their README for prompt injection attempts and also audit the included package.json for security advisories? I want a verdict before we let it anywhere near our system."}],"resultDescription":"A JSON object containing: a top-level verdict ('safe', 'caution', or 'avoid'); a packages array with per-dependency name, spec, version checked, vulnerability count, and verdict; a summary block with counts of checked, skipped, vulnerable, and over-limit packages; a ranked fixes array with package name, recommended upgrade version, reason, and priority; the detected ecosystem and manifest type; and an optional readme_screen field with prompt injection findings if a README was supplied.","failureModes":["Manifest exceeds 200,000 character limit — request rejected","README exceeds 50,000 character limit — readme field truncated or rejected","More than 25 dependencies in manifest — excess packages listed in 'skipped' and not checked","OSV.dev lookup failure for one or more packages — affected packages counted in lookup_failed","Invalid or unrecognizable manifest format — type detection fails and error returned","Malformed JSON request body — 400 error returned","Network timeout reaching OSV.dev advisories backend — partial results or error"],"whenToPreferThis":"Choose this endpoint when an AI agent needs a security gate before installing or executing any npm or PyPI project — especially for third-party or user-submitted code. It is purpose-built for agent workflows (x402 micropayment, structured verdict output) and uniquely combines CVE scanning via OSV.dev, deprecation and version staleness checks, and README prompt injection screening in a single call, making it superior to generic package audit tools when the agent needs a machine-readable go/no-go verdict rather than a human-facing report.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:47.760Z","isFirstParty":false,"canonicalSlug":"agent-tools-bundle-dependency-audit-a8eaeff7"}