flowrail-dep-check · FlowRail Docs

When it runs

On the pre-bash hook for any install command (npm install, npm ci, pip install). The hook reads the lockfile diff and calls this skill before the install command actually executes.

What you see in Claude Codev0.4.2

↳ npm install argon2 jose
  flowrail-dep-check  · allow
    ✓ argon2@0.40.1   approved range, clean provenance, no CVEs
    ✓ jose@5.9.6      approved range, clean provenance, no CVEs

MCP toolv0.4.2

flowrail_check_dep_install

Requestv0.4.2

{
  "design_review_id": "dr_7f3a9e2c",
  "ecosystem":        "npm",
  "lockfile_diff": [
    { "name": "argon2", "from": null, "to": "0.40.1" },
    { "name": "jose",   "from": null, "to": "5.9.6"  }
  ]
}

Responsev0.4.2

{
  "decision": "allow",
  "verdicts": [
    {
      "name":       "argon2",
      "version":    "0.40.1",
      "verdict":    "allow",
      "approved_range_match": true,
      "signals":    {
        "provenance_drop": false,
        "version_anomaly": false,
        "active_cves": []
      }
    }
  ]
}

Server-side, every call emits dep_install_checked with the resolved package set, the registry signals, and the verdict. This skill sends lockfile diffs and registry metadata only, no source code.