What problem does it solve? Manually evaluating every dependency in a project for takeover or exploitation risk is slow and error-prone. This Skill systematically checks each dependency against defined risk criteria and produces a structured report highlighting the ones that need attention. ## Core Features & Use Cases - Risk Factor Evaluation: Flags dependencies with single or anonymous maintainers, stale maintenance, low popularity, high-risk features like FFI or deserialization, past CVEs, or missing security contacts. - Accurate Data via GitHub CLI: Uses the gh tool to query real numbers for stars, open issues, and repository activity instead of guessing. - Structured Report with Alternatives: Generates a results.md report from a template, including counts by risk factor, a high-risk dependency table, and suggested better-maintained replacements. - Use Case: Before a security engagement, run the audit on a client's repository to identify unmaintained or single-maintainer dependencies and recommend drop-in replacements. ## Quick Start Audit this project's dependencies for supply chain risk and generate a report of high-risk packages with suggested alternatives.
