Use OWASP dep-scan as a pre-adoption or pre-release gate when an agent is about to trust a repository, dependency set, container image, Kubernetes manifest, or generated application bundle. The operator installs the scanner, points it at the source directory or image, chooses the project type when needed, and captures reports for vulnerability triage, license review, SBOM/VDR evidence, reachability analysis, package risk audit, and supported-language findings. This fits agent-maintained dependency reviews, CI release checks, and generated-code acceptance workflows where the output must be reviewable before a human approves the change. It also gives security reviewers a repeatable local command and report directory to attach to pull requests or release notes. Invoke this instead of manually checking package pages when the decision needs repeatable evidence before a dependency is added, promoted, or shipped. The boundary is local dependency and container risk scanning for agent workflows and CI gates; it is not a generic security platform card and does not replace broader dynamic application testing.