Dependency Compliance Audit

Use this skill when package choice or package governance is the main blocker.

Trigger Conditions

Use this skill when:

• the user asks whether a new dependency is safe or acceptable to adopt
• license, policy, provenance, or supply-chain concerns are in scope
• a stale, risky, or vulnerable package needs to be evaluated
• package upgrade pressure is affecting release confidence
• the team needs a dependency-focused review before merge or release

Do not use this skill for general code security review, product design, or final release signoff across the whole change.

Workflow

1. Identify the dependency or dependency set under review.
2. Clarify whether the concern is security, license, policy, maintenance, provenance, or upgrade compatibility.
3. Separate direct dependency concerns from broader code-path concerns.
4. Classify risk and likely decision options.
5. Recommend the smallest next action with the best tradeoff.
6. Suggest any follow-up review or documentation needed.

Output

For non-trivial work, provide:

• dependency scope reviewed
• main risk categories
• likely policy or release concerns
• recommended decision path
• follow-up verification or documentation

Coordination

After audit:

• use security-review if dependency concerns expand into runtime trust-boundary issues
• use docs-writer if policy or migration notes should be recorded
• use ship-readiness if package choice remains a release blocker

Invocation Examples

• "Use dependency-compliance-audit to review whether this new package is safe to adopt."
• "Use dependency-compliance-audit because the main concern is license and supply-chain fit."
• "Use dependency-compliance-audit to assess whether this outdated package is still acceptable for release."