dependency-auditor

Dependency auditing automatically scans your project for known vulnerabilities in dependencies using standard tools like npm audit, pip-audit, and bundle audit. The skill monitors dependency files (package.json, requirements.txt, Gemfile, pom.xml, go.mod) and alerts you to CVEs and security risks before deployment.

Yes, dependency auditing supports Node.js (npm, yarn), Python (pip), Ruby (bundler), Java (Maven, Gradle), and Go modules. It automatically detects which dependency files are present in your project and applies the appropriate audit tool for each ecosystem.

Yes, the skill integrates with CI/CD workflows for pre-deployment checks. It triggers automatically when dependency files change and provides real-time alerts, preventing vulnerable code from reaching production by gating deployments on audit results.

When you add a vulnerable package, the skill immediately detects it, categorizes the severity, proposes fixes, and alerts you to breaking changes. For example, adding an outdated version triggers detection of known CVEs with recommendations to upgrade to a secure version.

Yes, the skill scans for known vulnerabilities, outdated packages, and license issues. It categorizes severity levels and proposes fixes, providing comprehensive visibility into dependency risks beyond just CVE detection.

The skill triggers automatically when dependency files change and before deployments. This provides real-time alerts and immediate feedback whenever your dependencies are modified, ensuring you catch vulnerabilities as soon as they're added.