Nightforge
Store
AI Rules File

Dependency Guardrails — AI Agent Rules for Package Verification

A drop-in CLAUDE.md rules file that makes Claude Code, Cursor, Windsurf, and Copilot verify every package they add against the real registry before it lands in your lockfile — stops hallucinated ("slopsquatted"), abandoned, and typosquatted dependencies from AI coding agents.

Created

Description

A 2025 academic study found LLMs recommend nonexistent packages in roughly 1 in 5 code samples, and attackers now register those exact hallucinated names ahead of time — a technique called slopsquatting. This bundle is a 410-line CLAUDE.md that gives any AI coding agent a concrete verification protocol before it adds, upgrades, or recommends a dependency: confirm the package exists on the real registry (with real API endpoints for npm, PyPI, crates.io, Go modules, RubyGems, and Composer), check its maintenance signal, screen for typosquat/name-confusion risk against real historical incidents, and confirm the API surface it's about to call actually exists in the installed version. Also covers lockfile discipline, abandoned-dependency handling, security defaults, a pre-commit checklist, a red-flag blocklist, three worked before/after examples, monorepo-specific pitfalls, and an optional CI audit gate. Stack-agnostic — pairs with any of this store's stack-specific config bundles rather than replacing them.

What's included

  • CLAUDE.md — 410-line dependency verification rules file (the verification protocol, lockfile discipline, abandoned-dependency handling, security defaults, pre-commit checklist, red-flag blocklist, 3 worked examples, monorepo pitfalls, optional CI gate, and a quick-reference command appendix for 6 package ecosystems)
  • README.md — installation for Claude Code, Cursor, Windsurf, and GitHub Copilot, plus what this does not do (96 lines)
  • CUSTOMIZATION.md — how to trim it to one ecosystem, combine it with a stack-specific bundle, or pair it with a hard technical enforcement gate (62 lines)

Delivery

Instant download after Stripe checkout. File: nightforge-dependency-guardrails-bundle.zip