dependency-auditor

# Dependency Auditor

> **Skill Type:** POWERFUL · **Category:** Engineering · **Domain:** Dependency Management & Security

Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do **not** call live advisory APIs; pair their findings with `npm audit` / `pip-audit` / `cargo audit` for current CVE coverage.

## Quick Start

```bash
# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)
python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json

# 2. Check license compliance and conflicts
python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json

# 3. Plan upgrades from the scanner's inventory
python3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json
```

Consume the outputs: `scan.json` findings drive which packages to pin/patch now; `licenses.json` conflicts go to the user as a legal-risk list; `plan.json` orders upgrades by risk with rollback notes. `--quick-scan` skips transitive deps; `--security-only` limits the plan to security fixes.

**Verification loop:** after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.

## Supported Ecosystems

| Language | Manifests parsed |
|---|---|
| JavaScript/Node | package.json, package-lock.json, yarn.lock |
| Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |
| Go | go.mod, go.sum |
| Rust | Cargo.toml, Cargo.lock |
| Ruby | Gemfile, Gemfile.lock |
| Java | pom.xml, gradle.lockfile |
| PHP | composer.json, composer.lock |
| C#/.NET | packages.config, project.assets.json |

## License Classification

- **Permissive**: MIT, Apache 2.0, BSD (2/3-clause), ISC
- **Copyleft (strong)**: GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects
- **Copyleft (weak)**: LGPL v2.1/v3, MPL 2.0
- **Proprietary / Dual / Unknown** — unknown licenses are surfaced for manual review

The checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions.

## Upgrade Risk Matrix

| Risk | Update type | Handling |
|---|---|---|
| Low | Patch, security fixes | Apply immediately |
| Medium | Minor with new features | Batch into scheduled update |
| High | Major version, API changes | Dedicated migration task + tests |
| Critical | Known breaking changes | Planned migration with rollback procedure |

Prioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention.

## Scripts (accurate capability claims)

- **`scripts/dep_scanner.py`** — multi-format parser; built-in offline vulnerability pattern set (~16 CVE patterns — a smoke layer, not a replacement for live advisories); transitive resolution from lockfiles; JSON + text output.
- **`scripts/license_checker.py`** — license detection from package metadata; compatibility matrix across 20+ license types; `--policy permissive|strict`; conflict detection with remediation.
- **`scripts/upgrade_planner.py`** — semver-based breaking-change prediction; risk-ordered migration plan with testing checklist and timeline estimation.

Sample fixtures: `test-project/` and `test-inventory.json` in this folder; expected shapes in `expected_outputs/`.

## CI Integration

```bash
# Security gate in CI
python3 scripts/dep_scanner.py . --format json --fail-on-high
python3 scripts/license_checker.py . --policy strict --format json
```

## Best Practices

1. **Prioritize security**: address high/critical findings immediately; license compliance before functionality.
2. **Gradual updates**: incremental upgrades with thorough testing; feature flags for risky bumps.
3. **Cadence**: security scans per commit; license audits monthly; full audit quarterly.
4. **False positives**: whitelist with documentation; contact maintainers for license ambiguity.

See [README.md](README.md) for detailed usage and `references/` for the vulnerability/license knowledge bases.

{
  "format": "aiskill/v1",
  "skill": {
    "name": "dependency-auditor",
    "slug": "dependency-auditor",
    "version": "1.0.0",
    "description": "Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.",
    "category": "Development",
    "tags": [
      "engineering",
      "security",
      "frontend"
    ],
    "platforms": [
      "chatgpt",
      "claude-code",
      "cursor"
    ],
    "tested_environment": "Agent Skills convention (SKILL.md) — works with Claude Code, Cursor, ChatGPT/Codex and compatible agents",
    "license": "MIT"
  },
  "prompts": {
    "system": "# Dependency Auditor\r\n\r\n> **Skill Type:** POWERFUL · **Category:** Engineering · **Domain:** Dependency Management & Security\r\n\r\nOffline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do **not** call live advisory APIs; pair their findings with `npm audit` / `pip-audit` / `cargo audit` for current CVE coverage.\r\n\r\n## Quick Start\r\n\r\n```bash\r\n# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)\r\npython3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json\r\n\r\n# 2. Check license compliance and conflicts\r\npython3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json\r\n\r\n# 3. Plan upgrades from the scanner's inventory\r\npython3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json\r\n```\r\n\r\nConsume the outputs: `scan.json` findings drive which packages to pin/patch now; `licenses.json` conflicts go to the user as a legal-risk list; `plan.json` orders upgrades by risk with rollback notes. `--quick-scan` skips transitive deps; `--security-only` limits the plan to security fixes.\r\n\r\n**Verification loop:** after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.\r\n\r\n## Supported Ecosystems\r\n\r\n| Language | Manifests parsed |\r\n|---|---|\r\n| JavaScript/Node | package.json, package-lock.json, yarn.lock |\r\n| Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |\r\n| Go | go.mod, go.sum |\r\n| Rust | Cargo.toml, Cargo.lock |\r\n| Ruby | Gemfile, Gemfile.lock |\r\n| Java | pom.xml, gradle.lockfile |\r\n| PHP | composer.json, composer.lock |\r\n| C#/.NET | packages.config, project.assets.json |\r\n\r\n## License Classification\r\n\r\n- **Permissive**: MIT, Apache 2.0, BSD (2/3-clause), ISC\r\n- **Copyleft (strong)**: GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects\r\n- **Copyleft (weak)**: LGPL v2.1/v3, MPL 2.0\r\n- **Proprietary / Dual / Unknown** — unknown licenses are surfaced for manual review\r\n\r\nThe checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions.\r\n\r\n## Upgrade Risk Matrix\r\n\r\n| Risk | Update type | Handling |\r\n|---|---|---|\r\n| Low | Patch, security fixes | Apply immediately |\r\n| Medium | Minor with new features | Batch into scheduled update |\r\n| High | Major version, API changes | Dedicated migration task + tests |\r\n| Critical | Known breaking changes | Planned migration with rollback procedure |\r\n\r\nPrioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention.\r\n\r\n## Scripts (accurate capability claims)\r\n\r\n- **`scripts/dep_scanner.py`** — multi-format parser; built-in offline vulnerability pattern set (~16 CVE patterns — a smoke layer, not a replacement for live advisories); transitive resolution from lockfiles; JSON + text output.\r\n- **`scripts/license_checker.py`** — license detection from package metadata; compatibility matrix across 20+ license types; `--policy permissive|strict`; conflict detection with remediation.\r\n- **`scripts/upgrade_planner.py`** — semver-based breaking-change prediction; risk-ordered migration plan with testing checklist and timeline estimation.\r\n\r\nSample fixtures: `test-project/` and `test-inventory.json` in this folder; expected shapes in `expected_outputs/`.\r\n\r\n## CI Integration\r\n\r\n```bash\r\n# Security gate in CI\r\npython3 scripts/dep_scanner.py . --format json --fail-on-high\r\npython3 scripts/license_checker.py . --policy strict --format json\r\n```\r\n\r\n## Best Practices\r\n\r\n1. **Prioritize security**: address high/critical findings immediately; license compliance before functionality.\r\n2. **Gradual updates**: incremental upgrades with thorough testing; feature flags for risky bumps.\r\n3. **Cadence**: security scans per commit; license audits monthly; full audit quarterly.\r\n4. **False positives**: whitelist with documentation; contact maintainers for license ambiguity.\r\n\r\nSee [README.md](README.md) for detailed usage and `references/` for the vulnerability/license knowledge bases.",
    "user_template": ""
  },
  "variables": [],
  "install": {
    "steps": [
      {
        "title": "Download & unzip",
        "detail": "Download the .zip package from SkillVault and unzip it. The dependency-auditor/ folder contains SKILL.md plus any companion scripts, references and assets."
      },
      {
        "title": "Copy into your agent skills directory",
        "detail": "Move the folder into your agent's skills directory — e.g. ~/.claude/skills/ (Claude Code), .codex/skills/, .cursor/skills/ or your project's .claude/skills/ folder — then restart or reload the session."
      },
      {
        "title": "Use it",
        "detail": "Describe the task in natural language; the agent loads the skill automatically when the request matches the skill description."
      }
    ]
  },
  "usage": {
    "steps": []
  },
  "metadata": {
    "author": "SkillVault",
    "source": "https://skillvault.top/skills/dependency-auditor",
    "exported_at": "2026-11-03T07:43:28.280Z"
  }
}

format: aiskill/v1
skill:
  name: dependency-auditor
  slug: dependency-auditor
  version: 1.0.0
  description: >-
    Audit and manage dependencies across multi-language projects. Identifies vulnerabilities,
    license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing
    third-party packages before release, investigating a CVE, planning a major version bump, or
    running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL
    contamination', 'plan the upgrade to React 19'.
  category: Development
  tags:
    - engineering
    - security
    - frontend
  platforms:
    - chatgpt
    - claude-code
    - cursor
  tested_environment: >-
    Agent Skills convention (SKILL.md) — works with Claude Code, Cursor, ChatGPT/Codex and
    compatible agents
  license: MIT
prompts:
  system: "# Dependency Auditor\r\n\r\n> **Skill Type:** POWERFUL · **Category:** Engineering · **Domain:** Dependency Management & Security\r\n\r\nOffline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do **not** call live advisory APIs; pair their findings with `npm audit` / `pip-audit` / `cargo audit` for current CVE coverage.\r\n\r\n## Quick Start\r\n\r\n```bash\r\n# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)\r\npython3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json\r\n\r\n# 2. Check license compliance and conflicts\r\npython3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json\r\n\r\n# 3. Plan upgrades from the scanner's inventory\r\npython3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json\r\n```\r\n\r\nConsume the outputs: `scan.json` findings drive which packages to pin/patch now; `licenses.json` conflicts go to the user as a legal-risk list; `plan.json` orders upgrades by risk with rollback notes. `--quick-scan` skips transitive deps; `--security-only` limits the plan to security fixes.\r\n\r\n**Verification loop:** after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.\r\n\r\n## Supported Ecosystems\r\n\r\n| Language | Manifests parsed |\r\n|---|---|\r\n| JavaScript/Node | package.json, package-lock.json, yarn.lock |\r\n| Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |\r\n| Go | go.mod, go.sum |\r\n| Rust | Cargo.toml, Cargo.lock |\r\n| Ruby | Gemfile, Gemfile.lock |\r\n| Java | pom.xml, gradle.lockfile |\r\n| PHP | composer.json, composer.lock |\r\n| C#/.NET | packages.config, project.assets.json |\r\n\r\n## License Classification\r\n\r\n- **Permissive**: MIT, Apache 2.0, BSD (2/3-clause), ISC\r\n- **Copyleft (strong)**: GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects\r\n- **Copyleft (weak)**: LGPL v2.1/v3, MPL 2.0\r\n- **Proprietary / Dual / Unknown** — unknown licenses are surfaced for manual review\r\n\r\nThe checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions.\r\n\r\n## Upgrade Risk Matrix\r\n\r\n| Risk | Update type | Handling |\r\n|---|---|---|\r\n| Low | Patch, security fixes | Apply immediately |\r\n| Medium | Minor with new features | Batch into scheduled update |\r\n| High | Major version, API changes | Dedicated migration task + tests |\r\n| Critical | Known breaking changes | Planned migration with rollback procedure |\r\n\r\nPrioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention.\r\n\r\n## Scripts (accurate capability claims)\r\n\r\n- **`scripts/dep_scanner.py`** — multi-format parser; built-in offline vulnerability pattern set (~16 CVE patterns — a smoke layer, not a replacement for live advisories); transitive resolution from lockfiles; JSON + text output.\r\n- **`scripts/license_checker.py`** — license detection from package metadata; compatibility matrix across 20+ license types; `--policy permissive|strict`; conflict detection with remediation.\r\n- **`scripts/upgrade_planner.py`** — semver-based breaking-change prediction; risk-ordered migration plan with testing checklist and timeline estimation.\r\n\r\nSample fixtures: `test-project/` and `test-inventory.json` in this folder; expected shapes in `expected_outputs/`.\r\n\r\n## CI Integration\r\n\r\n```bash\r\n# Security gate in CI\r\npython3 scripts/dep_scanner.py . --format json --fail-on-high\r\npython3 scripts/license_checker.py . --policy strict --format json\r\n```\r\n\r\n## Best Practices\r\n\r\n1. **Prioritize security**: address high/critical findings immediately; license compliance before functionality.\r\n2. **Gradual updates**: incremental upgrades with thorough testing; feature flags for risky bumps.\r\n3. **Cadence**: security scans per commit; license audits monthly; full audit quarterly.\r\n4. **False positives**: whitelist with documentation; contact maintainers for license ambiguity.\r\n\r\nSee [README.md](README.md) for detailed usage and `references/` for the vulnerability/license knowledge bases."
  user_template: ""
variables: []
install:
  steps:
    - title: Download & unzip
      detail: >-
        Download the .zip package from SkillVault and unzip it. The dependency-auditor/ folder
        contains SKILL.md plus any companion scripts, references and assets.
    - title: Copy into your agent skills directory
      detail: >-
        Move the folder into your agent's skills directory — e.g. ~/.claude/skills/ (Claude Code),
        .codex/skills/, .cursor/skills/ or your project's .claude/skills/ folder — then restart or
        reload the session.
    - title: Use it
      detail: >-
        Describe the task in natural language; the agent loads the skill automatically when the
        request matches the skill description.
usage:
  steps: []
metadata:
  author: SkillVault
  source: https://skillvault.top/skills/dependency-auditor
  exported_at: "2026-11-03T07:43:28.280Z"