skills.rest
rob-broadley
rob-broadleyCOMMUNITY
Explore all skills by this author →
GitHub

dependency-review

Audit third-party dependencies for security, license, and supply-chain risks.

Updated May 10, 2026
Search Tags:#dependency audit#vulnerability scanning#supply chain security#license compliance#transitive risk#version hygiene
One-click install
npx skills add https://github.com/rob-broadley/ai-airbase --skill dependency-review-rob-broadley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-review
Source: https://github.com/rob-broadley/ai-airbase/tree/main/cadre/skills/dependency-review
Command: npx skills add https://github.com/rob-broadley/ai-airbase --skill dependency-review-rob-broadley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you reduce security, legal, and supply-chain risk introduced by third-party dependencies by providing a structured checklist for auditing what you ship.

Core Features & Use Cases

  • Vulnerability and reachability signals: Run OSV scanning to detect CVEs across common lockfiles and prioritize findings based on whether code paths are likely reachable.
  • Abandonment and maintenance health: Assess staleness, lack of maintainer responsiveness, archived status, and bus-factor-1 risks to identify likely future breakage.
  • License compatibility and transitive obligations: Detect licenses with Trivy where supported and reason about permissive vs copyleft impacts (including AGPL considerations).
  • Supply chain integrity checks: Evaluate publish-author changes, ownership transfers, typosquatting risk, dependency confusion, and install-time script abuse.
  • Version hygiene and upgrade prioritisation: Detect floating/unpinned versions, missing lockfiles, pre-release usage, and recommend upgrades using severity × surface area / upgrade risk.

Quick Start

Use the dependency-review skill to audit the dependencies in your current project directory and produce a prioritized plan to remediate the highest-impact security, maintenance, and licensing risks.

Frequently Asked Questions about dependency-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan lockfiles for security vulnerabilities and transitive risks?▼

Scanning lockfiles for security vulnerabilities uses OSV-based CVE detection to assess transitive graphs, identify risky dependencies, and provide structured remediation guidance based on severity.

What is reachability-aware prioritization for dependency vulnerability scanning?▼

Reachability-aware prioritization evaluates whether vulnerable code paths in dependencies are likely reachable, helping you focus remediation efforts on CVEs that pose an actual threat to your project.

How can I check license compliance and detect copyleft obligations in project dependencies?▼

Checking license compliance detects permissive vs copyleft impacts, including AGPL considerations, using Trivy scanning where supported to identify transitive license obligations across your dependency graph.

Does dependency auditing detect supply chain integrity issues like typosquatting and dependency confusion?▼

Dependency auditing detects supply chain integrity issues by evaluating publish-author changes, ownership transfers, typosquatting risk, dependency confusion, and install-time script abuse across ecosystems.

What is the best way to prioritize dependency upgrades using severity and surface area?▼

Prioritizing dependency upgrades uses a severity × surface area / upgrade risk formula to evaluate version hygiene, detect floating versions, and recommend high-impact remediation actions.

How do I assess maintenance health and abandonment risk for third-party libraries?▼

Assessing maintenance health identifies staleness, lack of maintainer responsiveness, archived status, and bus-factor-1 risks to pinpoint dependencies likely to cause future breakage.

Related Skills

Explore More Legal & Compliance Skills→
rajveersingh11rajveersingh11

dependency-triage

Identifies outdated packages and CVEs in software dependencies for risk management.

Community
Intermediate
vecearvecear

dependency-vulnerability-triage

Convert npm audit and Snyk reports into prioritized patch plans.

Community
Advanced
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced
HouseGarofaloHouseGarofalo
3

security-scanner

Scan container images, dependencies, and IaC for security vulnerabilities.

Official
Advanced