Meterian Security Audit

You have access to the Meterian CLI (@meterian/cli). Always invoke it via npx @meterian/cli (not a bare meterian command) — this ensures cross-language support and access to the full Meterian advisory database.

Language Parameter Reference

Always use the following mapping to determine the language parameter:

Mode A — Full Dependency Audit

When asked to audit, scan, or check all dependencies:

1. Find all manifest files in the workspace using Glob (search for the filenames in the Language Parameter Reference table above)

2. Extract dependencies with their pinned versions:

   • If a lock file is available, extract all dependencies from it (direct and transitive) — lock files contain the full resolved dependency tree
   • If no lock file is available, extract direct dependencies from the manifest; use the minimum bound of any version range as the version to check

3. Build a JSON array of {language, name, version} objects and pipe it to the CLI:

echo '<json-array>' | npx @meterian/cli check

4. The CLI returns a compact JSON report. Present results in one single table — one row per vulnerability — using exactly these five column headers: Package, Version, Severity, ID, Safe Versions. Do not split information across multiple tables. Include a summary line in exactly this format: X vulnerabilities found across Y packages (Z clean).

## Meterian Security Audit Report

| Package | Version | Severity | ID | Safe Versions |
|---------|---------|----------|----|---------------|
| lodash  | 4.17.15 | HIGH     | CVE-2021-23337 | 4.17.21 |
...

X vulnerabilities found across Y packages (Z clean).

If vulnerable is empty, output: "✅ No vulnerabilities detected across N packages."

5. After presenting the report, if vulnerabilities were found:

   • Offer remediation (see Mode C below)
   • Ask if the user would like to run a reachability analysis to determine which vulnerabilities are actually exploitable in their codebase.
     • If yes → invoke the reachability-analysis skill, including the list of vulnerable packages (name, version, CVE ID) in the invocation prompt
     • If no → end the audit flow

   If no vulnerabilities were found, the audit is complete — do not propose reachability analysis.

Mode B — Ad-hoc Security Query

When asked "is [library] [version] safe?" or similar:

1. Identify the library name and version from the question
2. Determine the language from context (file open in editor, explicit mention, or ask the user)
3. Run:

npx @meterian/cli advisories get <language> <name> <version>

4. Report findings inline: list each advisory with its severity, id, and description

Mode C — Remediation

For each vulnerable dependency:

1. The check output already contains safeVersions — an array ordered [latestPatch, latestMinor, latestMajor] (nulls excluded). Select the first (least-disruptive) entry.
2. Determine the bump level:
   • Patch: apply automatically
   • Minor or Major: show the proposed change and ask for confirmation before applying

Update the version in the manifest file and/or run the ecosystem's install command (e.g. npm install lodash@4.17.21, cargo update -p <crate>, pip install <pkg>==<ver>).

After applying all fixes, re-run the full audit (Mode A). If new vulnerabilities are found, repeat the remediation cycle. If all are clean, output: "✅ All packages are now clean."