Agent skill · security · borghei
dependency-auditor
Scan project dependencies for vulnerabilities, license issues, and upgrade opportunities across Python, Node.js, Go, and Rust. Use when auditing dependencies, checking licenses, planning upgrades, or assessing supply chain security.
Why this skill is useful
Adds executable scripts for vulnerability scanning, license checking, and upgrade planning that enhance dependency management capabilities.
What it needs
Requires python installed locally. About 4k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Dependency Auditor A multi-language toolkit for analyzing, auditing, and managing dependencies. It scans manifests and lockfiles across 8+ ecosystems to surface vulnerabilities, classify licenses, detect bloat, and produce safe, phased upgrade plans — giving teams visibility into security, legal, and maintenance risk hidden in their dependency trees. Core Capabilities Vulnerability scanning & CVE matching — match direct/transitive deps against a built-in CVE database with CVSS scoring across Node, Python, Go, Rust, Ruby, Java, PHP, .NET. License compliance — classify into permissive / weak-copyleft / strong-copyleft / proprietary / unknown tiers and detect incompatible combinations (e.g. GPL contamination). Outdated & maintenance detection — categorize updates by patch/minor/major severity; flag abandoned or end-of-life packages. Dependency bloat analysis — find unused, redundant, or oversized packages and consolidation opportunities. Upgrade path planning — semver breaking-change prediction, risk matrix, prioritization, rollback strategies. Supply chain security — provenance checks, typosquatting/malicious-package detection, transitive risk scoring. Lockfile analysis — validate freshness, integrity hashes, and cross-environment consistency for deterministic builds. When to Use Auditing a project's dependencies for vulnerabilities or supply-chain risk. Checking license compliance before distribution or M&A due diligence. Planning safe, phased dependency upgrades. Adding a dependency security gate to CI/CD. Cleaning up unused or redundant dependencies. Clarify First Before running the audit, confirm these inputs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/dependency-auditor