skills.rest
briiirussell
briiirussellCOMMUNITY
Explore all skills by this author →
GitHub

dependency-audit

Audit project dependencies and lockfiles for known CVEs and supply-chain risks.

345|47|Updated Mar 13, 2026
Search Tags:#dependency audit#ci/cd security#supply chain security#cves#lockfile integrity#framework misconfiguration#package vulnerabilities
One-click install
npx skills add https://github.com/briiirussell/cybersecurity-skills --skill dependency-audit-briiirussell
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-audit
Source: https://github.com/briiirussell/cybersecurity-skills/tree/main/skills/dependency-audit
Command: npx skills add https://github.com/briiirussell/cybersecurity-skills --skill dependency-audit-briiirussell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It identifies known vulnerabilities and security anti-patterns across your project’s dependencies, frameworks, runtimes, and dev tooling so you can reduce real-world risk before deployment.

Core Features & Use Cases

  • Stack inventory across ecosystems: Reads common lockfiles and manifest files (Node, Python, Ruby, Go, Rust, Java, PHP, .NET) plus CI/CD and container/IaC tooling to build a full dependency picture.
  • Automated CVE discovery via the right audit tools: Runs ecosystem-appropriate scanners (for example npm audit, pip-audit/safety, bundle audit, govulncheck, cargo audit, composer audit, container scanners, and filesystem scans).
  • Framework-specific weakness checks + supply-chain validation: Surfaces recurring framework misconfigs and supply-chain indicators like dependency confusion, typosquatting, malicious install scripts, and weak lockfile/CI practices.

Quick Start

Run the dependency-audit skill after describing your tech stack and providing your lockfiles and relevant config files so it can inventory packages, check CVEs, and return a prioritized remediation plan.

Frequently Asked Questions about dependency-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan dependencies for known vulnerabilities before deployment?▼

Dependency vulnerability scanning parses project lockfiles and manifests to run ecosystem-specific audit commands, detecting CVEs, supply-chain risks, and framework misconfigurations to produce prioritized remediation guidance.

Can I audit npm, pip, and cargo lockfiles for security issues in one pass?▼

Yes, you can audit lockfiles across Node, Python, Rust, Ruby, Go, Java, PHP, and .NET ecosystems simultaneously. The process reads common manifest files and applies the appropriate audit scanner for each environment to detect vulnerabilities.

What's the best way to detect supply-chain risks like dependency confusion in my project?▼

Detect supply-chain risks by validating lockfile integrity and scanning package manifests for dependency confusion, typosquatting, malicious install scripts, and weak CI practices alongside standard CVE checks to surface actionable prioritized fixes.

Does dependency auditing work with CI/CD and container infrastructure configurations?▼

Dependency auditing works with CI/CD and container/IaC tooling by reading relevant configuration files to inventory packages. It identifies security anti-patterns and supply-chain risks across your development toolchain and runtime environments.

How do I triage package vulnerabilities by runtime reachability?▼

Triage package vulnerabilities by parsing dependency manifests, running appropriate audit commands, and verifying version applicability to categorize findings by runtime reachability, producing a prioritized and actionable remediation plan.

Related Skills

Explore More Software Engineering Skills→
thejefflarsonthejefflarson
20

supply-chain

Audit dependency manifests and CI configurations for supply-chain risks.

Community
Advanced
nahisahonahisaho
12

security-auditor

Audit code, configurations, and dependencies for security vulnerabilities.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
fusenginefusengine
22

dependency-audit

Audit project dependencies for known security vulnerabilities using ecosystem-specific tools.

Community
Intermediate