agentsclimarketplace
Sign in

Dependency audit

Skill jakesterns/agent-skills/skills/code-quality/dependency-audit

Audits dependency files and package changes for vulnerable packages, risky upgrades, license concerns, and supply-chain exposure.From its SKILL.md

Install
npx -y skills add jakesterns/agent-skills --skill dependency-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, as published. Nobody here has run it

Dependency Audit

Use this skill when reviewing changes to package manifests, lockfiles, container base images, GitHub Actions, language toolchains, or third-party SDKs.

Inputs

  • Changed dependency files such as package.json, lockfiles, pyproject.toml, requirements.txt, go.mod, Cargo.toml, Gemfile, Dockerfiles, or workflow YAML
  • Project language, runtime, deployment target, and risk tolerance

Steps

  1. Identify added, removed, upgraded, and downgraded dependencies.
  2. Check whether new dependencies are necessary or duplicate existing capability.
  3. Review package reputation signals: maintainer, activity, license, transitive footprint, native code, install scripts, and known ecosystem risk.
  4. Look for risky version changes: major upgrades, downgrades, unpinned versions, broad ranges, prerelease packages, or unexpected lockfile churn.
  5. Inspect build and install hooks for arbitrary code execution or network access.
  6. Check license compatibility and note unknown or restrictive licenses.
  7. Review container and CI dependencies for overprivileged images, mutable tags, deprecated actions, or untrusted third-party actions.
  8. Recommend safer alternatives, pinning, upgrade sequencing, or additional validation.

Output

Provide:

  • Dependency change summary
  • Risk table with package/action/image, change, risk, and recommendation
  • Required follow-up checks such as audit commands, SBOM generation, or license review
  • Merge recommendation: accept, accept with follow-up, or block

Guidelines

  • Do not claim a package is vulnerable without evidence from available context.
  • Treat unexpected lockfile churn as a review signal.
  • Prefer reducing dependency count when a small local implementation is safer.

Keep looking

Skills are one crate of 626,194. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.