Dependency audit

Skill Hayatelin/devsecops-skills/skills/dependency-audit

A security skills pack for Claude Code, Cursor, Codex and Gemini CLI: secrets pre-flight, dependency audit, secret rotation, STRIDE threat modeling, secure code review, Dockerfile hardening and env hygiene.

Install

npx -y skills add Hayatelin/devsecops-skills --skill dependency-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit project dependencies for known vulnerabilities, risky packages, and supply-chain hazards. Trigger when the user says "audit dependencies", "check for vulnerable packages", "is this package safe", before a release, or after adding/upgrading a dependency.

SKILL.md

3.1 KB, as published. Nobody here has run it

When to use

After adding, upgrading, or unpinning a dependency.
Before cutting a release or merging to a protected branch.
When the user asks "are any of our packages vulnerable?" or "is <package> safe to install?"
When a Dependabot/Renovate alert or CVE lands.

Process

Identify the ecosystem(s) from lockfiles present: package-lock.json/pnpm-lock.yaml/yarn.lock (npm), requirements.txt/poetry.lock/uv.lock (Python), go.sum (Go), Cargo.lock (Rust), Gemfile.lock (Ruby).
Run the native auditor for each ecosystem:
- npm: npm audit --omit=dev (or pnpm audit / yarn npm audit)
- Python: pip-audit (or uv pip audit); fall back to safety check if needed
- Go: govulncheck ./...
- Rust: cargo audit
- Ruby: bundle audit check --update
Optionally run a cross-ecosystem SCA pass (osv-scanner -r .) to catch anything the native tool misses.
Triage each finding by severity AND reachability — a critical CVE in an unused transitive dep is lower urgency than a medium one in a hot path.
Manually eyeball newly added packages for supply-chain red flags (see checklist).
Propose the minimal safe upgrade and re-run the auditor to confirm the fix.

What to check

Known CVEs / advisories in direct and transitive dependencies, with a fixed version available.
Typosquats — names one edit away from a popular package (reqeusts, python-dateutil vs dateutil, lodahs).
Unmaintained deps — no release in 2+ years, archived repo, single maintainer, or deprecated on the registry.
Supply-chain smells — install/postinstall scripts, brand-new package with sudden version jumps, maintainer handover, obfuscated code, network calls at install time.
License risk — copyleft (GPL/AGPL) creeping into a permissive-licensed product.
Lockfile integrity — lockfile committed, hashes present, and no latest/floating ranges in production deps.

How to fix

Bump to the patched version (npm update <pkg>, pip install -U <pkg>, edit + re-lock). Prefer the smallest semver jump that clears the advisory.
If no fix exists: pin away from the bad range, apply an override/resolution to force a safe transitive version, or replace the package.
Remove dead dependencies entirely rather than carrying their risk.
Add an overrides/resolutions (npm) or constraints file (pip) to hold transitive deps at safe versions.
Wire the auditor into CI so regressions are caught automatically.

Report back

List findings as a short table: package, current → fixed version, severity, CVE/advisory ID, and direct-vs-transitive. State which you upgraded, which need a manual decision (breaking change, no fix), and any typosquat/unmaintained flags. End with a clear "audit clean" or "N issues remaining" verdict.