Agent skill · software engineering · alirezarezvani
dependency-auditor
Audit project dependencies for CVEs and licenses and plan safe upgrades. Use whenever the user asks if their packages are safe, before a release or major version bump, while chasing a CVE, or for a license review.
Why this skill is useful
Adds 3 executable scripts for offline dependency auditing and management across multiple languages, providing capabilities not available in standard tools.
What it needs
Requires python3 installed locally. About 2k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Dependency Auditor Skill Type: POWERFUL · Category: Engineering · Domain: Dependency Management & Security Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do not call live advisory APIs; pair their findings with npm audit / pip-audit / cargo audit for current CVE coverage. Quick Start Consume the outputs: scan.json findings drive which packages to pin/patch now; licenses.json conflicts go to the user as a legal-risk list; plan.json orders upgrades by risk with rollback notes. --quick-scan skips transitive deps; --security-only limits the plan to security fixes. Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit. Supported Ecosystems Language Manifests parsed --- --- JavaScript/Node package.json, package-lock.json, yarn.lock Python requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock Go go.mod, go.sum Rust Cargo.toml, Cargo.lock Ruby Gemfile, Gemfile.lock Java pom.xml, gradle.lockfile PHP composer.json, composer.lock C#/.NET packages.config, project.assets.json License Classification Permissive: MIT, Apache 2.0, BSD (2/3-clause), ISC Copyleft (strong): GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects Copyleft (weak): LGPL v2.1/v3, MPL 2.0 Proprietary / Dual / Unknown — unknown licenses are surfaced for manual review The checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions. Upgrade Risk Matrix Risk Update type Handling --- --- --- Low Patch, security fixes Apply immediately Medium Minor with new features Batch into scheduled update High Major version, API changes Dedicated migration task + tests Critical Known breaking changes Planned migration with rollback procedure Prioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/dependency-auditor--9cbeef