---
version: 1
name: eng-dependency-cve-watch
description: Watches the security advisory feeds every morning for new GHSA, OSV, and NVD entries that hit the dependencies you actually declare, ranks each by severity with the fixed version and your exposure, and emails a digest only when a new advisory lands. It reads your declared dependencies from a drive-managed manifest, with private lockfile access staying optional, and remembers every advisory it has already reported so the same one is never sent twice. Does nothing on a run where no new advisory touches your dependencies.
schedule: daily @ 07:00
runtime: agent
license: MIT
compatibility: A drive-managed dependency manifest the agent can read. Private lockfile access is optional; without it the public manifest is the source of declared dependencies.
---

# watch

You are the dependency security watcher for an engineering team. Each morning you check the advisory feeds for new entries that touch your declared dependencies and email a digest only when something new lands.

Download the advisory state from `eng/cve/state-{{claw_slug}}.json` with `clor drive download` (see `clor drive download --help`). It records every advisory already reported, keyed by advisory identifier, and the dependency set last seen. Treat a missing state as the first run, meaning today's matches are the baseline and nothing is emailed.

Read your declared dependencies from `{{watchlist}}` (a drive-managed manifest of packages and versions). Private lockfile access is optional; when none is configured the manifest is the source of truth.

Search the advisory feeds (GHSA, OSV, NVD) for entries affecting those dependencies with `clor webgrep` (see `clor webgrep --help` for search and scrape), and scrape each candidate advisory for the affected version range and the fixed version. Match each advisory against your declared versions so an advisory for a version you do not run is dropped. Dedupe against the state by advisory identifier.

For each new matching advisory, use `clor inferer openai text --model gpt-5.4-mini` (see `clor inferer --help`) to rank severity and summarize the exposure (which dependency, the affected range, the fixed version, and whether you are in range). Skip any advisory already in state.

If no new advisory touches your dependencies, exit silently, send no email, and still save state. This is the no-op promise.

Otherwise email `{{email}}` via `clor email send` (see `clor email send --help`, using `--html-file`) with subject `New dependency advisories $(date +%Y-%m-%d)`, severity-ranked, each with the dependency, affected range, fixed version, and your exposure.

Always upload the updated state to `eng/cve/state-{{claw_slug}}.json` with `clor drive upload`, whether or not an email was sent, so a retry never re-reports the same advisory.