How does it handle license compliance?

It classifies licenses into permissive, copyleft, and proprietary categories, identifying potential conflicts and legal risks within your direct and transitive dependency trees.

Does it provide remediation for security vulnerabilities?

It identifies specific CVEs, provides CVSS severity scores, and suggests safe upgrade paths to versions where the vulnerabilities have been patched.

Can this be used in CI/CD pipelines?

Yes, Dependency Auditor is designed to integrate into automated workflows as a security gate, allowing you to fail builds based on vulnerability severity or license violations.

Which programming languages does Dependency Auditor support?

The skill supports a wide range of ecosystems including JavaScript (Node.js), Python, Go, Rust, Ruby, Java (Maven/Gradle), PHP, and C# (.NET).

Can it detect unused dependencies?

Yes, it analyzes import statements and usage patterns to identify redundant or oversized packages that aren't actually being used in your code, helping reduce bundle size.

Dependency Auditor

Name: Dependency Auditor
Author: borghei

byborghei

•

安全与测试

Scans and audits project dependencies to identify security vulnerabilities, license compliance issues, and optimization opportunities across multiple programming languages.

The Dependency Auditor is a comprehensive security and maintenance toolkit designed to manage the complex ecosystem of third-party libraries in modern software projects. It enables developers and security teams to proactively identify CVEs, resolve legal risks associated with open-source licenses, and streamline upgrade paths for Python, Node.js, Go, and Rust environments. By providing deep visibility into both direct and transitive dependencies, it helps reduce technical debt and prevents supply chain attacks through automated analysis and actionable risk assessments during the development lifecycle.

主要功能

01Intelligent upgrade path planning using semantic versioning and breaking change prediction.

02Supply chain security verification including lockfile integrity and package provenance tracking.

0350 GitHub stars

04Automated license compliance auditing with legal risk classification and conflict detection.

05Dependency bloat analysis to identify unused, redundant, or oversized packages.

06Multi-language vulnerability scanning with real-time CVE matching and CVSS scoring.

使用场景

01Performing deep security audits and vulnerability assessments before production releases.

02Automating open-source license compliance checks for legal due diligence and distribution.

03Reducing technical debt by identifying and pruning unused or unmaintained dependencies.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add borghei/claude-skills dependency-auditor

For use in Claude.ai and ChatGPT

Download Skill