skills.rest
hamzaPixl
hamzaPixlCOMMUNITY
Explore all skills by this author →
Website𝕏@pixlHamzaGitHub

dependency-review

Audit project dependencies for vulnerabilities, outdated versions, license conflicts, and unused packages.

2|Updated Mar 16, 2026
Search Tags:#npm#pip#vulnerability-scanning#dependency-audit#go-modules#license-audit#unused-deps
One-click install
npx skills add https://github.com/hamzaPixl/pixl-ai --skill dependency-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-review
Source: https://github.com/hamzaPixl/pixl-ai/tree/main/packages/crew/skills/dependency-review
Command: npx skills add https://github.com/hamzaPixl/pixl-ai --skill dependency-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates auditing a project's dependencies to find vulnerabilities, outdated packages, license conflicts, and unused libraries so teams can prioritize fixes and reduce security and maintenance risk.

Core Features & Use Cases

  • Multi-ecosystem detection: Supports npm, yarn, pnpm, bun, pip/poetry, and Go modules.
  • Vulnerability scanning: Parses audit outputs and classifies CVE severity for actionable triage.
  • Outdated and breaking change identification: Detects major, minor, and patch differences and highlights potential breaking upgrades.
  • License and compliance checks: Flags copyleft, missing, or incompatible licenses and evaluates license compatibility with the project license.
  • Unused dependency detection: Cross-references source imports with declared dependencies to recommend removals.
  • Use Case: Run across a monorepo to produce a prioritized remediation report listing critical CVEs, major upgrades, license blockers, and likely unused packages.

Quick Start

Ask the skill to run a full dependency review on the repository and produce a prioritized remediation report with vulnerability details, upgrade recommendations, license issues, and unused package suggestions.

Frequently Asked Questions about dependency-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and pip dependencies for vulnerabilities in a monorepo?▼

You can audit dependencies for vulnerabilities in a monorepo by parsing lockfiles and audit outputs across npm, yarn, pnpm, bun, pip/poetry, and Go modules to classify CVE severities and generate a remediation report.

How does license compatibility checking work for project dependencies?▼

License compatibility checking flags copyleft, missing, or incompatible licenses by evaluating them against your project license to identify potential compliance blockers in your dependency tree.

Can I detect unused npm packages and Go modules in my project?▼

Yes, you can detect unused dependencies by cross-referencing source imports with declared packages across npm, pip, and Go modules to recommend safe removals and reduce maintenance risk.

What is the best way to find outdated dependencies and breaking changes in a Node.js project?▼

Finding outdated dependencies involves detecting major, minor, and patch version differences in your lockfiles, highlighting potential breaking upgrades to help prioritize package update tasks.

Does dependency auditing support bun and pnpm lockfiles?▼

Yes, dependency auditing supports bun and pnpm lockfiles alongside npm, yarn, pip/poetry, and Go modules, parsing their specific outputs to scan for vulnerabilities and license conflicts.

Related Skills

Explore More Software Engineering Skills→
ConsiliencyConsiliency
8

dependency-sync

Detect new imports in modified files and install missing dependencies across package managers.

Official
Intermediate
AgentSecOpsAgentSecOps
183

sca-blackduck

Identify open-source component vulnerabilities and license risks across CI/CD pipelines.

Official
Advanced
az9713az9713

dependency-audit

Audit project dependencies for vulnerabilities, license issues, and bloat.

Community
Intermediate
fusenginefusengine
22

dependency-audit

Audit project dependencies for known security vulnerabilities using ecosystem-specific tools.

Community
Intermediate