Dependency Checker

This is a review checklist, not an installed monitor. If you need a Monday 9am run, create and verify a weekly OpenClaw Automation in the intended time zone. A HEARTBEAT.md instruction does not reserve that time. Grant read-only access to the repositories and a notification channel before enabling delivery.

For each approved repository:
1. Query open Dependabot alerts with an authorized GitHub identity. Example for one repository:
   gh api --paginate 'repos/OWNER/REPO/dependabot/alerts?state=open&per_page=100'
   GitHub requires Dependabot alerts read permission for a fine-grained token. Record the query time and repository. If the request is denied, the feature is disabled, or the call fails, report an unknown scan state, never zero alerts.
2. For each returned alert, record its URL, affected package, advisory severity, affected dependency scope if available, and whether an applicable fix is offered. Route newly observed urgent alerts to a human to verify reachability, exposure, and remediation. A severity label alone is not proof of exploitation. Do not auto-dismiss or install a patch from an agent prompt.
3. Separately run the repository's own package-manager version check, such as pnpm outdated or npm outdated for a Node project. List old versions in the routine update report. A newer package version is not itself a security advisory. A missing tool or registry failure is an incomplete report, not a clean bill of health.
4. Keep a last-seen alert ID and notification state so the same open advisory does not page every week. Summarize open alerts, new versus already reported items, outdated versions, and repositories that could not be checked. Verify one alert and one query-failure notification in a controlled setup before trusting delivery.

This checklist does not configure GitHub alerts, prove dependency coverage, install a schedule, or measure whether a fix reached production.