dependency-analyst

To audit dependencies for known vulnerabilities, this Skill performs deep dependency analysis and manifest auditing to identify outdated packages, detect version drift, and highlight supply chain risks. It proactively scans your codebase for packages with known CVEs.

The best way to check npm and Python dependencies for license conflicts is by running a supply-chain risk assessment. This Skill examines transitive dependencies across various language ecosystems to highlight potential licensing conflicts and known security exploits.

To detect version drift between manifest files and lock files, you can perform a manifest auditing process. This Skill verifies consistency between files like package.json or requirements.txt and their corresponding lock files to identify outdated or vulnerable dependencies.

Yes, dependency analysis works for transitive packages in a project. This Skill examines project dependencies, including transitive ones, across various language ecosystems to identify vulnerable packages and provide upgrade and pinning recommendations.

Yes, you can use this Skill to scan your codebase before a major release. A development team can run the dependency-analyst script to perform a full audit, ensuring a more secure product by identifying dependencies with known CVEs.

Dependency auditing flags specific packages as risks to highlight potential supply chain threats, licensing conflicts, or known security exploits. This process identifies outdated or vulnerable dependencies and provides actionable upgrade and pinning recommendations.