dependency-review

What problem does it solve?

This Skill automates auditing a project's dependencies to find vulnerabilities, outdated packages, license conflicts, and unused libraries so teams can prioritize fixes and reduce security and maintenance risk.

Core Features & Use Cases

• Multi-ecosystem detection: Supports npm, yarn, pnpm, bun, pip/poetry, and Go modules.
• Vulnerability scanning: Parses audit outputs and classifies CVE severity for actionable triage.
• Outdated and breaking change identification: Detects major, minor, and patch differences and highlights potential breaking upgrades.
• License and compliance checks: Flags copyleft, missing, or incompatible licenses and evaluates license compatibility with the project license.
• Unused dependency detection: Cross-references source imports with declared dependencies to recommend removals.
• Use Case: Run across a monorepo to produce a prioritized remediation report listing critical CVEs, major upgrades, license blockers, and likely unused packages.

Quick Start

Ask the skill to run a full dependency review on the repository and produce a prioritized remediation report with vulnerability details, upgrade recommendations, license issues, and unused package suggestions.