dependency-audit
Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.
npx skills add mohitagw15856/pm-claude-skills --skill dependency-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Dependency Audit Skill Produce a complete dependency audit report for a project — covering security vulnerabilities (with CVE references), license compliance against policy, outdated packages prioritised by risk, transitive dependency risk analysis, and a concrete remediation plan with timeline. A good dependency audit gives the team a clear, prioritised action list — not a raw dump of audit output that no one acts on. ## Required Inputs Ask for these if not already provided: - **Project language and ecosystem** — npm, pip/PyPI, Maven/Gradle, Go modules, Cargo, RubyGems, NuGet, or mixed - **Dependency list or package manifest** — paste the contents of `package.json`, `requirements.txt`, `go.mod`, `pom.xml`, etc., or provide the audit tool output - **License policy** — which licenses are allowed, which are restricted (e.g. "GPL is prohibited", "MIT/Apache/BSD only", or "no policy yet — recommend one") - **Current security tooling** — Dependabot, Snyk, OWASP Dependency-Check, npm audit, pip-audit, or none ## Output Format --- # Dependency Audit Report: [Project Name] **Ecosystem:** [npm / pip / Maven / Go / etc.] **Audit date:** [Date] **Auditor:** [Name] **Total direct dependencie
- Required Inputs
- Output Format
- Executive Summary
- 1. Security Vulnerability Findings
- Critical and High Severity (Act within 24–72 hours)
- Medium Severity (Fix within 30 days)
- Low Severity (Fix within 90 days or accept risk)
- Vulnerabilities With No Fix Available
- 2. License Compliance Matrix
- License Policy Reference
- Findings: Packages With Compliance Issues
- All Licenses in Use (Full Inventory)
- 3. Outdated Package Analysis
- Severely Outdated (2+ major versions behind — high upgrade effort)
Commands for Week 1 upgrades: npm npm install [package]@[target-version] npm audit fix --force # use with caution — may introduce breaking changes pip pip install --upgrade [package]==[target-version] pip-audit --fix # if using pip-audit Go go get [module]@[version] go mod tidy
What does the dependency-audit skill do?
Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill dependency-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.