dependency-auditor
Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.
Profile →npx skills add alirezarezvani/claude-skills --skill dependency-auditor --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Dependency Auditor > **Skill Type:** POWERFUL · **Category:** Engineering · **Domain:** Dependency Management & Security Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do **not** call live advisory APIs; pair their findings with `npm audit` / `pip-audit` / `cargo audit` for current CVE coverage. ## Quick Start ```bash # 1. Scan for vulnerabilities (built-in offline CVE pattern set; exit non-zero on high severity) python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json # 2. Check license compliance and conflicts python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json # 3. Plan upgrades from the scanner's inventory python3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json ``` Consume the outputs: `scan.json` findings drive which packages to pin/patch now; `licenses.json` conflicts go to the user as a legal-risk list; `plan.json` orders upgrades by risk with rollback notes. `--quick-scan` skips transitive deps; `--security-only` limits the plan to security fixe
- Quick Start
- Supported Ecosystems
- License Classification
- Upgrade Risk Matrix
- Scripts (accurate capability claims)
- CI Integration
- Best Practices
python3 scripts/dep_scanner.py /path/to/project --format json --fail-on-high -o scan.json python3 scripts/license_checker.py /path/to/project --policy strict --format json -o licenses.json python3 scripts/upgrade_planner.py scan.json --risk-threshold medium --timeline 90 --format json -o plan.json Security gate in CI python3 scripts/dep_scanner.py . --format json --fail-on-high python3 scripts/license_checker.py . --policy strict --format json
What does the dependency-auditor skill do?
Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.
How do I install it?
Run `npx skills add alirezarezvani/claude-skills --skill dependency-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From alirezarezvani/claude-skills, a repository with 23,791 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.