Skip to the rows

agentsclimarketplace

Dependency auditor

Skill DROOdotFOO/agent-skills/skills/dependency-auditor

Agent skills, autonomous agents, and MCP-companions for programming

Install

npx -y skills add DROOdotFOO/agent-skills --skill dependency-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Multi-language dependency vulnerability scanning and license compliance auditing. TRIGGER when: user asks to audit dependencies, check for vulnerabilities, review licenses, detect outdated or bloated packages, or assess supply chain risk. DO NOT TRIGGER when: user is adding a specific dependency they have already chosen, or debugging a build failure unrelated to dependency versions.

SKILL.md

3.3 KB, as published. Nobody here has run it

Dependency Auditor

What You Get

Vulnerability report with CVE IDs, CVSS scores, and fix recommendations
License compliance audit (copyleft flags, conflicts, missing licenses)
Prioritized upgrade plan with breaking change risk assessment

Philosophy

Dependencies are attack surface. Every transitive dependency is code you did not write, did not review, and may not maintain. Audit proactively, not after an incident.

Workflow: 5 Phases

Phase 1: Scan Dependencies

Detect the project's ecosystem(s) from lockfiles and manifests. A single project may use multiple ecosystems (e.g., Node frontend + Python backend). Identify:

Direct dependencies and their versions
Transitive dependency tree depth
Pinned vs floating version specifiers

Phase 2: Vulnerability Check

Run ecosystem-specific audit commands. See vulnerability-scanning.md for per-language tools. For each vulnerability:

CVE identifier and CVSS score
Affected version range
Whether a patched version exists
Whether the vulnerable code path is reachable in this project

Phase 3: License Audit

Classify every dependency's license. See license-compliance.md for the taxonomy. Flag:

Copyleft licenses in proprietary projects
License conflicts between dependencies
Dependencies with no declared license
Dual-licensed packages where the commercial license applies

Phase 4: Detect Bloat

Identify dependencies that are:

Unused (imported but never called)
Duplicated (multiple versions of the same package)
Oversized relative to their function (pulling in a framework for one utility)
Replaceable with standard library equivalents

Phase 5: Upgrade Plan

For each actionable finding, produce:

Priority (critical vuln > license issue > bloat)
Recommended action (upgrade, replace, remove, pin)
Breaking change risk for each upgrade
Test commands to verify the upgrade

Polyglot Coverage

Ecosystem	Manifest	Lockfile	Audit Tool
JavaScript/TypeScript	package.json	package-lock.json, yarn.lock, pnpm-lock.yaml	npm audit, yarn audit
Python	pyproject.toml, requirements.txt	poetry.lock, uv.lock	pip-audit, safety
Go	go.mod	go.sum	govulncheck
Rust	Cargo.toml	Cargo.lock	cargo-audit
Ruby	Gemfile	Gemfile.lock	bundler-audit
Elixir	mix.exs	mix.lock	mix_audit, sobelow
Java/Kotlin	pom.xml, build.gradle		dependency-check

Sub-files

File	Topic
vulnerability-scanning.md	Per-language audit commands, CVSS, supply chain
license-compliance.md	License classification, GPL contamination, SPDX

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.