{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "mah3sec-forgeguardian--scan-project-dependencies-locally",
 "repo": "Mah3Sec/ForgeGuardian",
 "repo_url": "https://github.com/Mah3Sec/ForgeGuardian",
 "repo_slug": "mah3sec-forgeguardian",
 "title": "Scan project dependencies for risks before release",
 "page_title": "How to scan project dependencies for risks before release with Forge Guardian",
 "summary": "Run one local scan to list dependency findings with severity and fix versions, without sending data out.",
 "who": "A developer preparing a release who wants to know which dependencies carry known CVEs or suspicious install scripts.",
 "problem": "Dependency lists grow quietly, and it is hard to see which packages have known vulnerabilities or malicious behavior.",
 "outcome": "A list of findings for the project with severity and fix versions, produced entirely on the local machine.",
 "steps": [
  "Install Forge Guardian with `curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash`",
  "Run `fgctl update` to refresh the community signatures",
  "Change into your project folder and run `fgctl scan .`",
  "Read the findings, noting severity and the fix version listed for each",
  "If an optional engine such as Grype, Trivy, or Semgrep is missing, run `fgctl doctor --fix`, then scan again"
 ],
 "agent_prompt": "Using the repo Mah3Sec/ForgeGuardian, install the CLI and run `fgctl scan .` on <project-path>. Report the findings with severity and fix versions. Verify that the scan ran offline by confirming the output lists engine results for the project's packages.",
 "agents": [
  "any"
 ],
 "difficulty": "Beginner",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "Grype, Trivy, and Semgrep are optional and only run when installed, so the default scan covers the five always-on engines.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "go",
 "requirements": [
  "A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker",
  "A project directory with dependencies to scan",
  "Git and make only if building from source"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "remote-script",
   "notice": "The install command pipes a script from GitHub directly into bash, so review install.sh first if your policy requires it."
  }
 ],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/mah3sec-forgeguardian/scan-project-dependencies-locally/",
 "md": "https://dedupedai.com/use-cases/mah3sec-forgeguardian/scan-project-dependencies-locally/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/mah3sec-forgeguardian--scan-project-dependencies-locally.json",
 "api_version": "v1"
}