upstream-atomic-crm/.claude/rules/dependency-safety.md

Dependency safety

Adding a new package is a supply-chain decision, so agents never do it silently.

Rule

• New-package installs are denied by permissions (settings.json -> permissions.deny: Bash(npm install *), Bash(npm i *), Bash(pnpm add *), Bash(yarn add *)). A deny is ~100% respected; a CLAUDE.md rule or a post-action warning is not.
• Bare npm install / pnpm install / yarn install (no package argument, restoring the lockfile) stays allowed: the literal space in the deny glob requires an argument, so an argument-less install is not matched.
• To add a package, the human validates THAT specific package first: minimum 21 days since publication, healthy download/maintainer count, no open advisory (npm audit, Snyk).

Third-party skills and MCP servers

• Treat a downloaded skill/plugin (marketplace or external repo) like an npm dependency: the same audits apply (they have shipped hardcoded secrets and malicious payloads).
• Pin an MCP server's version once validated; do not let it auto-update without a fresh human check.

Automatic blocking reduces risk, it does not remove it: a periodic security review is still required for anything touching auth, payments, or sensitive data.