Audit dependency supply chains for CVEs, licensing, and provenance risks.
npx skills add https://github.com/agentik-os/OmegaOS --skill depaudit
Please help me install this Agent Skill. Skill: depaudit Source: https://github.com/agentik-os/OmegaOS/tree/main/skills/audits/depaudit Command: npx skills add https://github.com/agentik-os/OmegaOS --skill depaudit
Forensic dependency & supply-chain audit v1 (Gestalt-Popper). 18-phase deep analysis of everything the project TRUSTS from third parties: dependency CVE exposure (direct + transitive), outdated and abandoned packages, license compliance and contamination, lockfile integrity and reproducible builds, transitive dependency bloat and duplication, typosquatting / dependency-confusion / namespace-takeover risk, postinstall and lifecycle script auditing, pinned vs floating version policy, SBOM generation and completeness, registry trust and provenance, bundle exposure (server deps leaking to client), monorepo workspace hygiene, plus verdict, fix plan, fix execution, re-audit, and build-integrity safety gate. Answers "Is the supply chain SAFE?" Score /360. Preamble v1.0 compliant. Complements /secaudit (which owns RUNTIME exploitation of CVEs) — depaudit owns STATIC supply-chain hygiene, provenance, licensing, and reproducibility. Audit -> Plan -> Fix -> Re-audit. Use when user says "/depaudit", "dependency audit", "supply chain audit", "audit dependencies", "is the supply chain safe", "are my packages safe", "outdated packages", "abandoned dependencies", "license audit", "license compliance", "lockfile integrity", "reproducible build", "typosquatting", "dependency confusion", "postinstall scripts", "SBOM", "software bill of materials", "audit deps", "package audit", "vendor audit", "third-party audit".
Initiate the depaudit workflow on your project to perform a full supply-chain audit and generate a remediation plan.
High-intent search queries and answers about installing and using this skill.
A dependency audit scans manifests and lockfiles to identify CVEs, licensing issues, and provenance risks across direct and transitive dependencies. It analyzes the resolved tree to surface drift, abandoned packages, and postinstall script risks for remediation.
Supply-chain provenance risk involves threats like typosquatting, dependency confusion, and namespace takeovers in third-party packages. Auditing provenance verifies registry trust and checks that resolved dependencies match expected sources for reproducible builds.
Yes, the audit applies to projects with manifests and lockfiles across ecosystems including npm, cargo, and pip. It analyzes the resolved dependency tree to detect version drift, transitive bloat, and abandoned packages across different package managers.
Generate an SBOM and check lockfile integrity by running a multi-phase audit of your manifests and resolved dependency tree. This process verifies pinned versus floating version policies and ensures reproducible builds through a structured evidence summary.
The best way is a static supply-chain audit that evaluates the full dependency tree for abandoned packages and postinstall script risks. This approach produces a structured fix-plan to remediate lifecycle script vulnerabilities and package abandonment issues.
Transitive dependency bloat and duplication occur when deeply nested indirect dependencies pull in redundant or outdated packages. A full audit of the lockfile and resolved tree surfaces this drift and generates a fix-plan to clean up the dependency graph.
Z-M-HuangValidate project dependencies against VCP dependency-management standards.
peterfoxAudit and upgrade npm packages across Node.js projects with lockfile support.
dazebTest Proxmox VE 8.x/9.x hypervisors for guest escape and supply chain vulnerabilities.
mitchellvandusen-cellAudit Python dependencies for CVEs, outdated packages, licenses, and unused imports.
