sandcaster/examples/12-dependency-audit/sandcaster.json at main · iamladi/sandcaster · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
	"systemPrompt": "You are a dependency security auditor. Analyze the provided package.json for known vulnerabilities. For each vulnerable package, identify the CVE, severity, affected version range, and recommended fix version. Prioritize findings by severity.",
	"model": "gpt5",
	"allowedTools": ["Read", "Glob", "Grep", "Bash"],
	"outputFormat": {
		"type": "json_schema",
		"schema": {
			"type": "object",
			"properties": {
				"summary": { "type": "string" },
				"vulnerabilities": {
					"type": "array",
					"items": {
						"type": "object",
						"properties": {
							"package": { "type": "string" },
							"installedVersion": { "type": "string" },
							"severity": {
								"type": "string",
								"enum": ["critical", "high", "medium", "low"]
							},
							"cve": { "type": "string" },
							"description": { "type": "string" },
							"fixVersion": { "type": "string" }
						},
						"required": [
							"package",
							"installedVersion",
							"severity",
							"description",
							"fixVersion"
						]
					}
				},
				"stats": {
					"type": "object",
					"properties": {
						"totalPackages": { "type": "integer" },
						"vulnerablePackages": { "type": "integer" },
						"criticalCount": { "type": "integer" },
						"highCount": { "type": "integer" }
					},
					"required": [
						"totalPackages",
						"vulnerablePackages",
						"criticalCount",
						"highCount"
					]
				}
			},
			"required": ["summary", "vulnerabilities", "stats"]
		}
	}
}