Dependency Auditor
Dependency Auditor is an offline, deterministic auditing skill for multi-language projects. It scans manifests and lockfiles across 8+ ecosystems to identify vulnerabilities, license conflicts, and transitive dependency risks, and generates upgrade plans with risk prioritization.
✨ What it does
- Scans 8+ package ecosystems (npm, pip, Go, Rust, Ruby, Java, PHP, .NET) using manifest and lockfile parsers.
- Detects vulnerabilities using a built-in offline CVE pattern set (smoke layer, not a replacement for live advisories).
- Checks license compliance with a compatibility matrix and flags copyleft, proprietary, or unknown licenses.
- Generates risk-ordered upgrade plans with semver-based breaking-change prediction and rollback notes.
- Supports CI integration with exit codes for security gates.
- Provides JSON and text output formats for all scripts.
🎯 When to use it
- Before a release to audit third-party dependencies for vulnerabilities or license issues.
- When investigating a specific CVE or security advisory affecting your dependencies.
- When planning a major version upgrade (e.g., React 19) and need a risk-ordered migration plan.
- During a license-compliance review to check for GPL contamination or other conflicts.
🚀 How to use
Trigger by asking to audit dependencies, check licenses, or plan an upgrade. Provide a project path or inventory file. Run the three scripts in sequence: dep_scanner.py, license_checker.py, upgrade_planner.py. Example prompts:
audit our npm dependencies
plan the upgrade to React 19
📄 Output: Produces scan.json (vulnerability findings), licenses.json (license conflicts), and plan.json (risk-ordered upgrade plan).
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering/skills/dependency-auditor .claude/skills/dependency-auditorSkill source: engineering/skills/dependency-auditor/SKILL.md
⚠️ Good to know
The vulnerability detection is based on a limited offline pattern set and does not replace live advisory tools like npm audit or pip-audit; always pair with those for current CVE coverage.
❓ FAQ
Does the skill require internet access?
No, the scripts are offline and deterministic, using pattern matching over manifests and lockfiles.
What does the --fail-on-high flag do?
It makes the scanner exit with a non-zero code if high-severity vulnerabilities are found, useful for CI gates.
How are licenses classified?
Licenses are classified as permissive (MIT, Apache), copyleft strong/weak (GPL, LGPL), or proprietary/unknown, with conflicts flagged through dependency chains.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.