Your agent can watch dependency advisories

Watches the security advisory feeds every morning for new GHSA, OSV, and NVD entries that hit the dependencies you actually declare, ranks each by severity with the fixed version and your exposure, and emails a digest only when a new advisory lands. It reads your declared dependencies from a drive-managed manifest, with private lockfile access staying optional, and remembers every advisory it has already reported so the same one is never sent twice. Does nothing on a run where no new advisory touches your dependencies.