sc-dependency-audit

To scan project dependencies for vulnerabilities and supply-chain risks, this Skill automatically inventories manifests from npm, PyPI, crates.io, Maven Central, NuGet, Packagist, and Go modules. It outputs a consolidated risk report covering CVEs, typosquatting, and build-script behaviors.

Dependency confusion and typosquatting detection identify malicious packages mimicking legitimate internal or public dependencies. This Skill analyzes project manifests to flag these supply-chain risks alongside known CVEs, yanked versions, and risky build-time behaviors across supported ecosystems.

Auditing npm, PyPI, and Go module dependencies for license compliance and deprecation requires analyzing project manifests. This Skill automatically identifies aged, deprecated, or yanked versions and checks license concerns, generating a comprehensive security report suitable for audits.

Yes, this dependency audit works with Maven Central and crates.io manifests. It supports projects using npm, PyPI, crates.io, Maven Central, NuGet, Packagist, and Go modules, analyzing them for vulnerabilities, typosquatting, and build-script risks.

The best way to generate a security audit report for known CVEs and risky build-scripts is running a full dependency audit. This Skill consolidates vulnerability scanning, build-script risk detection, and license compliance checks into an organized report across multiple package ecosystems.

Yes, you can detect yanked package versions and deprecated dependencies. This Skill performs vulnerability scanning across supported ecosystems to identify yanked versions, deprecated packages, known CVEs, and supply-chain risks like dependency confusion.