Dependency Auditor
FreeAudit and manage dependencies across multi-language projects.
Free · Opens the source repo
What Dependency Auditor does
Dependency Auditor is a powerful tool designed for developers and teams managing multi-language projects. It provides offline, deterministic auditing of dependencies across more than eight package ecosystems, allowing users to identify vulnerabilities, license conflicts, and transitive dependency risks without relying on live advisory APIs. This is particularly useful when preparing for releases, investigating known vulnerabilities, or ensuring compliance with licensing requirements. The tool consists of three main scripts that analyze various manifest and lock files, producing actionable outputs that guide users in maintaining secure and compliant codebases.
The core functionality revolves around three scripts: dep_scanner.py, license_checker.py, and upgrade_planner.py. The dependency scanner identifies vulnerabilities based on a built-in set of offline CVE patterns, while the license checker evaluates license compliance against a comprehensive matrix of over 20 license types. The upgrade planner organizes potential upgrades by risk, providing a timeline and rollback notes for major version changes. This structured approach helps teams prioritize security and compliance, ensuring that critical issues are addressed promptly.
Dependency Auditor is ideal for software engineers, DevOps teams, and project managers who need to maintain a high standard of security and compliance in their projects. By integrating this skill into their workflow, users can proactively manage dependencies, reduce the risk of security breaches, and streamline the upgrade process. The outputs generated by the scripts facilitate informed decision-making, helping teams navigate the complexities of dependency management effectively.
In summary, Dependency Auditor empowers teams to audit and manage their project dependencies systematically. By leveraging its capabilities, users can enhance their software security posture, ensure license compliance, and plan upgrades with confidence, ultimately leading to more robust and maintainable applications.
When to use it
Use Dependency Auditor when preparing for a release, conducting a license compliance review, or planning major version upgrades in your software projects.
When not to use it
This skill may not be suitable for real-time vulnerability monitoring or projects that require constant online access to the latest advisory data.
What you can build with it
Pre-release Audit
Run Dependency Auditor to ensure all dependencies are secure and compliant before a software release.
License Compliance Review
Utilize the license checker to identify potential license conflicts in your project's dependencies.
Upgrade Planning
Generate an upgrade plan to systematically address dependencies that require updates, prioritizing based on risk.
How to install Dependency Auditor
View source1. Install with the skills CLI
npx skills add alirezarezvani/claude-skills/dependency-auditor --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by alirezarezvaniDependency Auditor
Skill Type: POWERFUL · Category: Engineering · Domain: Dependency Management & Security
Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do not call live advisory APIs; pair their findings with npm audit / pip-audit / cargo audit for current CVE coverage.
Quick Start
# 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity)
python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json
# 2. Check license compliance and conflicts
python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json
# 3. Plan upgrades from the scanner's inventory
python3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json
Consume the outputs: scan.json findings drive which packages to pin/patch now; licenses.json conflicts go to the user as a legal-risk list; plan.json orders upgrades by risk with rollback notes. --quick-scan skips transitive deps; --security-only limits the plan to security fixes.
Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.
Supported Ecosystems
| Language | Manifests parsed |
|---|---|
| JavaScript/Node | package.json, package-lock.json, yarn.lock |
| Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |
| Go | go.mod, go.sum |
| Rust | Cargo.toml, Cargo.lock |
| Ruby | Gemfile, Gemfile.lock |
| Java | pom.xml, gradle.lockfile |
| PHP | composer.json, composer.lock |
| C#/.NET | packages.config, project.assets.json |
License Classification
- Permissive: MIT, Apache 2.0, BSD (2/3-clause), ISC
- Copyleft (strong): GPL v2/v3, AGPL v3 — flags contamination risk in permissive projects
- Copyleft (weak): LGPL v2.1/v3, MPL 2.0
- Proprietary / Dual / Unknown — unknown licenses are surfaced for manual review
The checker analyzes license inheritance through dependency chains and emits conflict pairs with remediation suggestions.
Upgrade Risk Matrix
| Risk | Update type | Handling |
|---|---|---|
| Low | Patch, security fixes | Apply immediately |
| Medium | Minor with new features | Batch into scheduled update |
| High | Major version, API changes | Dedicated migration task + tests |
| Critical | Known breaking changes | Planned migration with rollback procedure |
Prioritization: security patches > bug fixes > feature updates > major rewrites; deprecated features get immediate attention.
Scripts (accurate capability claims)
scripts/dep_scanner.py— multi-format parser; built-in offline vulnerability pattern set (~16 CVE patterns — a smoke layer, not a replacement for live advisories); transitive resolution from lockfiles; JSON + text output.scripts/license_checker.py— license detection from package metadata; compatibility matrix across 20+ license types;--policy permissive|strict; conflict detection with remediation.scripts/upgrade_planner.py— semver-based breaking-change prediction; risk-ordered migration plan with testing checklist and timeline estimation.
Sample fixtures: test-project/ and test-inventory.json in this folder; expected shapes in expected_outputs/.
CI Integration
# Security gate in CI
python3 scripts/dep_scanner.py . --format json --fail-on-high
python3 scripts/license_checker.py . --policy strict --format json
Best Practices
- Prioritize security: address high/critical findings immediately; license compliance before functionality.
- Gradual updates: incremental upgrades with thorough testing; feature flags for risky bumps.
- Cadence: security scans per commit; license audits monthly; full audit quarterly.
- False positives: whitelist with documentation; contact maintainers for license ambiguity.
See README.md for detailed usage and references/ for the vulnerability/license knowledge bases.
Frequently asked questions about Dependency Auditor
Similar skills
Quality Playbook Generator
Run comprehensive quality audits on any codebase.
PR Draft Summary
Automate PR summary generation for openai-agents-python.
Final Release Review
Streamline your release candidate audits with ease.
Unit Test Vue Pinia
Efficiently write and review unit tests for Vue 3 applications.
Slang Shader Expert
Optimize and integrate Slang shaders with ease.
Telemetry Standards
Ensure consistent event tracking in Supabase Studio.