dependency-auditor
Skill1 starsChanged 2 months agoMITView on GitHub
Multi-language dependency vulnerability scanning and license compliance auditing. TRIGGER when: user asks to audit dependencies, check for vulnerabilities, review licenses, detect outdated or bloated packages, or assess supply chain risk. DO NOT TRIGGER when: user is adding a specific dependency they have already chosen, or debugging a build failure unrelated to dependency versions.
We split this skill into the rules it gives an agent
2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.
0
Common
Most of the 12 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 36
Run ecosystem-specific audit commands.
- Distinctive: line 64
Test commands to verify the upgrade
“Common” is measured: kept by at least 6 in 10 of the 12 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Dependency Auditor
What You Get
- Vulnerability report with CVE IDs, CVSS scores, and fix recommendations
- License compliance audit (copyleft flags, conflicts, missing licenses)
- Prioritized upgrade plan with breaking change risk assessment
Philosophy
Dependencies are attack surface. Every transitive dependency is code you did not write, did not review, and may not maintain. Audit proactively, not after an incident.
Workflow: 5 Phases
Phase 1: Scan Dependencies
Detect the project's ecosystem(s) from lockfiles and manifests. A single project may use multiple ecosystems (e.g., Node frontend + Python backend). Identify:
- Direct dependencies and their versions
- Transitive dependency tree depth
- Pinned vs floating version specifiers
Phase 2: Vulnerability Check
Run ecosystem-specific audit commands. See vulnerability-scanning.md for per-language tools. For each vulnerability:
- CVE identifier and CVSS score
- Affected version range
- Whether a patched version exists
- Whether the vulnerable code path is reachable in this project
Phase 3: License Audit
Classify every dependency's license. See license-compliance.md for the taxonomy. Flag:
- Copyleft licenses in proprietary projects
- License conflicts between dependencies
- Dependencies with no declared license
- Dual-licensed packages where the commercial license applies
Phase 4: Detect Bloat
Identify dependencies that are:
- Unused (imported but never called)
- Duplicated (multiple versions of the same package)
- Oversized relative to their function (pulling in a framework for one utility)
- Replaceable with standard library equivalents
Phase 5: Upgrade Plan
For each actionable finding, produce:
- Priority (critical vuln > license issue > bloat)
- Recommended action (upgrade, replace, remove, pin)
- Breaking change risk for each upgrade
- Test commands to verify the upgrade
Polyglot Coverage
| Ecosystem | Manifest | Lockfile | Audit Tool |
| JavaScript/TypeScript | package.json | package-lock.json, yarn.lock, pnpm-lock.yaml | npm audit, yarn audit |
| Python | pyproject.toml, requirements.txt | poetry.lock, uv.lock | pip-audit, safety |
| Go | go.mod | go.sum | govulncheck |
| Rust | Cargo.toml | Cargo.lock | cargo-audit |
| Ruby | Gemfile | Gemfile.lock | bundler-audit |
| Elixir | mix.exs | mix.lock | mix_audit, sobelow |
| Java/Kotlin | pom.xml, build.gradle | dependency-check |
Sub-files
| File | Topic |
| vulnerability-scanning.md | Per-language audit commands, CVSS, supply chain |
| license-compliance.md | License classification, GPL contamination, SPDX |
Other versions13 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 13
- OneWave-AI/claude-skills★ 378same name
- mar-antaya/my-claude-skills★ 148same name
- Hassaan146/claude-skills★ 18same name
- goldenprofile/llm-skills★ 3same name
- csiddhant796-blip/claude-skills-collection★ 2same name
- Hussain-Elfalah/Agentic-Skills★ 2same name
- mDevsLabs/Skills★ 2same name
- miptah21/skills★ 2same name
- Kur1sulab/whitebox★ 1same name
- mahiunfiltered/claude-code-skills★ 1same name
3 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use database-schema-designer and release-manager.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
nahisahoSkilldatabase-schema-designer
Copilot agent for database schema design, ER diagrams, normalization, DDL generation, and performance optimization
Also in 3 projects that use this
exzmSkillrelease-manager
Manages releases as a Release Manager/Tech Lead. Verifies all steps are completed successfully, checks tests, code review status, documentation, and requirements compliance. Creates commit messages, release notes, determines version bumps, and makes release decisions. Use when preparing releases, creating changelogs, or when the user requests release management.
Also in 3 projects that use this
In this repository61 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- adversarial-reviewerSkill
- agent-designerSkill
- architectSkill
- autoresearchSkill
- blockscoutSkill
- ci-cd-pipeline-builderSkill
- claude-apiSkill
- codebase-onboardingSkill
- code-reviewSkill
- coingeckoSkill
- database-designerSkill
- design-uxSkill
- digestSkill
- droo-stackSkill
- env-secrets-managerSkill
- ethskillsSkill
- ffmpeg-asmSkill
- focused-fixSkill
- frontend-slop-auditSkill
- git-guardrailsSkill
- git-worktree-managerSkill
- humanizerSkill
- interface-designerSkill
- llm-cost-optimizerSkill
- local-browser-inspectorSkill
- mcp-server-builderSkill
- native-codeSkill
- nixSkill
- noirSkill
- observability-designerSkill
- patchbotSkill
- performance-profilerSkill
- playwrightSkill
- polymathSkill
- prd-to-planSkill
- prepperSkill
- property-testingSkill
- qaSkill
- rag-architectSkill
- raxol-paymentsSkill
- raxolSkill
- raxol-symphonySkill
- recallSkill
- refactoring-strategySkill
- regenSkill
- releaseSkill
- security-auditorSkill
- self-improving-agentSkill
- sentinelSkill
- signozSkill
- skill-creatorSkill
- solidity-auditorSkill
- tddSkill
- tech-debt-trackerSkill
- ubiquitous-languageSkill
- watchdogSkill
- web-asset-generatorSkill
- writing-voiceSkill
- The first 60 shown.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.