dependency-auditor

To audit dependencies for security vulnerabilities and outdated packages, provide your project root directory. The skill analyzes dependency files like pyproject.toml and requirements.txt to report package versions, flag known CVEs, and identify updates.

You can find unused imports and dependencies by running an audit on your project root. The skill scans the codebase to identify packages declared in dependency files but never actually imported in your code.

Yes, the dependency audit works directly with pyproject.toml and requirements.txt files. It parses these specific dependency manifests to extract package versions and check them against known vulnerability databases.

The best way to check for known CVEs before a major release is to run a comprehensive dependency audit. This scans your project root to ensure all dependencies are up-to-date and free from critical security vulnerabilities.

You need to provide a project_root path because the vulnerability scan requires access to your local dependency files and source code. This allows the auditor to parse manifests like requirements.txt and detect unused imports.

When scanning dependencies for outdated packages, the analysis is limited to parsing declared manifests like pyproject.toml and requirements.txt. It evaluates direct dependencies and known vulnerabilities but does not perform deep recursive source builds.