skills.rest
jscott3201
jscott3201COMMUNITY
Explore all skills by this author →
GitHub

dep-audit

Audit dependencies for supply-chain, maintenance, license, and vulnerability risks.

2|Updated Apr 3, 2026
Search Tags:#supply-chain#package-management#dependency-audit#vulnerability-scan#license-check#transitive-deps#selenedb
One-click install
npx skills add https://github.com/jscott3201/ai-agent-skills --skill dep-audit-jscott3201
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-audit
Source: https://github.com/jscott3201/ai-agent-skills/tree/main/skills/dep-audit
Command: npx skills add https://github.com/jscott3201/ai-agent-skills --skill dep-audit-jscott3201

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify unsafe, unmaintained, or legally incompatible third-party packages before adoption and persist findings into the project knowledge graph so future sessions recall risks and decisions.

Core Features & Use Cases

  • Health Audit: Check recent downloads, last release, maintainer activity, and OpenSSF Scorecard to judge maintenance and adoption.
  • Vulnerability & Transitive Analysis: Run ecosystem audits, count and evaluate transitive dependencies, and surface unpatched CVEs.
  • License Compatibility: Verify license chains and flag copyleft or ambiguous licenses that could contaminate the project.
  • Supply Chain Signals: Detect typosquatting, suspicious release bursts, install-script risks, and binary artifacts.
  • Graph Integration: Produce clear ADOPT/CAUTION/REJECT recommendations and persist Dependency and SecurityConcern nodes to SeleneDB for cross-session tracking.

Quick Start

Audit the dependency [email protected] and provide a concise ADOPT/CAUTION/REJECT recommendation with findings and any SecurityConcern nodes written to the project's SeleneDB graph.

Frequently Asked Questions about dep-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm or PyPI dependencies for supply-chain risks before production adoption?▼

A dependency audit checks health metrics like recent downloads and maintainer activity, scans for unpatched CVEs, and validates license compatibility to generate an ADOPT, CAUTION, or REJECT recommendation for third-party libraries.

How do I check transitive dependencies for unpatched vulnerabilities and license conflicts?▼

Checking transitive dependencies involves running ecosystem audits to count nested packages, surfacing unpatched CVEs, and verifying license chains to flag copyleft or ambiguous licenses that could contaminate your project.

What supply-chain attack signals should I look for when evaluating a new package?▼

When evaluating a new package, look for typosquatting, suspicious release bursts, install-script risks, and binary artifacts. Combining these supply-chain signals with OpenSSF Scorecard checks helps judge maintenance and adoption safety.

Does this dependency audit approach work across npm, PyPI, and crates.io ecosystems?▼

Yes, this dependency audit approach works across npm, PyPI, and crates.io ecosystems. It evaluates third-party libraries for production use by applying health metrics, vulnerability scans, and license compatibility validation consistently across these platforms.

How do I persist dependency vulnerability findings for cross-session tracking?▼

To persist dependency vulnerability findings, write dependency and SecurityConcern nodes to SeleneDB via gql_query. This graph integration ensures future sessions recall supply-chain risks and adoption decisions within the project knowledge graph.

Related Skills

Explore More Software Engineering Skills→
KhoiwallKhoiwall

opensrc

Fetch source code from npm, PyPI, crates.io, and GitHub/GitLab repositories.

Community
Advanced
jscott3201jscott3201
2

deferred-tracking

Detect deferral language and persist DeferredItem and Gate records to SeleneDB.

Community
Advanced
skyllwtskyllwt
1.6k

visualize

Generate Obsidian graph configurations and Canvas knowledge maps from OmegaWiki JSONL data.

Community
Intermediate
machenjiemachenjie
4

package-dependency-management

Govern package-manager and dependency changes across lockfiles, licenses, and vulnerabilities.

Community
Advanced