agentleFS
Sign inStart free
kazemcodeskazemcodes/skill-tree/skills/dependency-auditor/SKILL.md

dependency-auditor

Skill1 starsChanged 5 months agoMITView on GitHub

Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.

15 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use agent-designer and release-manager.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • Arnav-0Skill

    agent-designer

    Use when the user asks to design multi-agent systems, create agent architectures, define agent communication patterns, or build autonomous agent workflows.

    Also in 3 projects that use this

  • exzmSkill

    release-manager

    Manages releases as a Release Manager/Tech Lead. Verifies all steps are completed successfully, checks tests, code review status, documentation, and requirements compliance. Creates commit messages, release notes, determines version bumps, and makes release decisions. Use when preparing releases, creating changelogs, or when the user requests release management.

    Also in 3 projects that use this

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 11 edited versions we read keep these.

  • 1

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.

    line 27

“Common” is measured: kept by at least 6 in 10 of the 11 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Dependency Auditor

Skill Type: POWERFUL · Category: Engineering · Domain: Dependency Management & Security

Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do not call live advisory APIs; pair their findings with npm audit / pip-audit / cargo audit for current CVE coverage.

Quick Start

# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)
python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json

# 2. Check license compliance and conflicts
python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json

# 3. Plan upgrades from the scanner's inventory
python3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json

Consume the outputs: scan.json findings drive which packages to pin/patch now; licenses.json conflicts go to the user as a legal-risk list; plan.json orders upgrades by risk with rollback notes. --quick-scan skips transitive deps; --security-only limits the plan to security fixes.

Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.

Supported Ecosystems

LanguageManifests parsed
JavaScript/Nodepackage.json, package-lock.json, yarn.lock
Pythonrequirements.txt, pyproject.toml, Pipfile.lock, poetry.lock
Gogo.mod, go.sum
RustCargo.toml, Cargo.lock
RubyGemfile, Gemfile.lock
Javapom.xml, gradle.lockfile
PHPcomposer.json, composer.lock
C#/.NETpackages.config, project.assets.json

License Classification

  • Permissive: MIT, Apache 2.0, BSD (2/3-clause), ISC
  • Copyleft (strong): GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects
  • Copyleft (weak): LGPL v2.1/v3, MPL 2.0
  • Proprietary / Dual / Unknown — unknown licenses are surfaced for manual review

The checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions.

Upgrade Risk Matrix

RiskUpdate typeHandling
LowPatch, security fixesApply immediately
MediumMinor with new featuresBatch into scheduled update
HighMajor version, API changesDedicated migration task + tests
CriticalKnown breaking changesPlanned migration with rollback procedure

Prioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention.

Scripts (accurate capability claims)

  • scripts/dep_scanner.py — multi-format parser; built-in offline vulnerability pattern set (~16 CVE patterns — a smoke layer, not a replacement for live advisories); transitive resolution from lockfiles; JSON + text output.
  • scripts/license_checker.py — license detection from package metadata; compatibility matrix across 20+ license types; --policy permissive|strict; conflict detection with remediation.
  • scripts/upgrade_planner.py — semver-based breaking-change prediction; risk-ordered migration plan with testing checklist and timeline estimation.

Sample fixtures: test-project/ and test-inventory.json in this folder; expected shapes in expected_outputs/.

CI Integration

# Security gate in CI
python3 scripts/dep_scanner.py . --format json --fail-on-high
python3 scripts/license_checker.py . --policy strict --format json

Best Practices

  1. Prioritize security: address high/critical findings immediately; license compliance before functionality.
  2. Gradual updates: incremental upgrades with thorough testing; feature flags for risky bumps.
  3. Cadence: security scans per commit; license audits monthly; full audit quarterly.
  4. False positives: whitelist with documentation; contact maintainers for license ambiguity.

See README.md for detailed usage and references/ for the vulnerability/license knowledge bases.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free