Individual skill

dependency-auditor

Audit project dependencies for CVEs and licenses and plan safe upgrades. Use whenever the user asks if their packages are safe, before a release or major version bump, while chasing a CVE, or for a license review.

engineering/skills/dependency-auditor/SKILL.md

Read pinned source

Source commit 8f082544116fc0d014188e521ca40304cdfc86b0

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 29,645
Repository last updated: Nov 11, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agentic-ai Repository topic
anthropic-claude Repository topic
claude-ai Repository topic
claude-code Repository topic
claude-skills Repository topic
claude-code-skills Repository topic
ai-coding-agent Repository topic
claude-code-plugins Repository topic
developer-tools Repository topic
openai-codex Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

README.mddoc · 15,211 bytes
SKILL.mdcore · 4,861 bytes
SKILL.mdcore · 4,861 bytes
SKILL.mdcore · 4,861 bytes
assets/sample_go.modasset · 2,108 bytes
assets/sample_package.jsonasset · 1,919 bytes
assets/sample_requirements.txtdoc · 1,107 bytes
expected_outputs/sample_license_report.txtdoc · 930 bytes
expected_outputs/sample_upgrade_plan.txtdoc · 2,061 bytes
expected_outputs/sample_vulnerability_report.jsonasset · 1,708 bytes
references/dependency_management_best_practices.mddoc · 18,189 bytes
references/license_compatibility_matrix.mddoc · 8,860 bytes
references/vulnerability_assessment_guide.mddoc · 14,453 bytes
scripts/dep_scanner.pyruns · 31,256 bytes
scripts/license_checker.pyruns · 44,397 bytes
scripts/upgrade_planner.pyruns · 42,650 bytes
test-inventory.jsonasset · 9,916 bytes
test-project/package.jsonruns · 1,919 bytes

Read excerpt


# Dependency Auditor

> **Skill Type:** POWERFUL · **Category:** Engineering · **Domain:** Dependency Management & Security

Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do **not** call live advisory APIs; pair their findings with `npm audit` / `pip-audit` / `cargo audit` for current CVE coverage.

## Quick Start

```bash
# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)
python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json

# 2. Check license compliance and conflicts
python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json