agentsclimarketplace

Dependency compliance audit

Skill motao123/dev-workflow-kit/dependency-compliance-audit

21 markdown-first software delivery workflow skills for Claude Code, Codex, and compatible agents. Standalone skill kit covering planning, debugging, CI, review, security, rollout, performance, data quality, and post-incident workflows.

Install
npx -y skills add motao123/dev-workflow-kit --skill dependency-compliance-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when the main question is whether a third-party dependency is acceptable to adopt, upgrade, keep, or ship. This skill focuses on package risk, license or policy fit, supply-chain awareness, and recommended next actions.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, as published. Nobody here has run it

Dependency Compliance Audit

Use this skill when package choice or package governance is the main blocker.

Trigger Conditions

Use this skill when:

  • the user asks whether a new dependency is safe or acceptable to adopt
  • license, policy, provenance, or supply-chain concerns are in scope
  • a stale, risky, or vulnerable package needs to be evaluated
  • package upgrade pressure is affecting release confidence
  • the team needs a dependency-focused review before merge or release

Do not use this skill for general code security review, product design, or final release signoff across the whole change.

Workflow

  1. Identify the dependency or dependency set under review.
  2. Clarify whether the concern is security, license, policy, maintenance, provenance, or upgrade compatibility.
  3. Separate direct dependency concerns from broader code-path concerns.
  4. Classify risk and likely decision options.
  5. Recommend the smallest next action with the best tradeoff.
  6. Suggest any follow-up review or documentation needed.

Output

For non-trivial work, provide:

  • dependency scope reviewed
  • main risk categories
  • likely policy or release concerns
  • recommended decision path
  • follow-up verification or documentation

Coordination

After audit:

  • use security-review if dependency concerns expand into runtime trust-boundary issues
  • use docs-writer if policy or migration notes should be recorded
  • use ship-readiness if package choice remains a release blocker

Invocation Examples

  • "Use dependency-compliance-audit to review whether this new package is safe to adopt."
  • "Use dependency-compliance-audit because the main concern is license and supply-chain fit."
  • "Use dependency-compliance-audit to assess whether this outdated package is still acceptable for release."

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.