review-deps

name	review-deps
description	Dependency review skill. Checks for known CVEs, abandoned packages, unnecessary dependencies, license compatibility, version pinning, and supply chain integrity.
argument-hint	Invoked by Review Coordinator - do not call directly

review-deps - Dependency Review Skill

This skill is invoked by the Review Coordinator as a subagent. It reviews project dependencies for security vulnerabilities, maintenance health, licensing, and supply chain concerns.

Input contract (received via subagent prompt):

1. Read this SKILL.md file for review instructions.
2. Read the specification file to understand dependency-relevant requirements (NFRs, security constraints, license requirements).
3. Identify the project's dependency manifest files (see known patterns below).
4. For each major dependency, use #tool:web to research known CVEs against trusted databases.
5. Evaluate each checklist item below.
6. Write structured findings to the specified output path.
7. Return a brief summary (counts of PASS/WARN/FAIL/N/A).

Constraint: Do NOT modify any source code, dependency files, the WP file, or the spec file. Only write to the specified output path (FR-028).

Known dependency manifest patterns:

• Python: requirements.txt, pyproject.toml, Pipfile, setup.py, setup.cfg
• JavaScript/TypeScript: package.json
• Rust: Cargo.toml
• Go: go.mod
• Java: pom.xml, build.gradle
• .NET: *.csproj, packages.config

Known lockfile patterns:

• Python: Pipfile.lock, poetry.lock, requirements.txt (with hashes)
• JavaScript: package-lock.json, yarn.lock, pnpm-lock.yaml
• Rust: Cargo.lock
• Go: go.sum

If no recognized dependency manifest is found, mark the entire skill as N/A.

---

Dependency Checklist

Category 1: Known CVEs (FR-048.1)

• For each major dependency, search for known CVEs via trusted sources
• Check NVD (nvd.nist.gov) for each dependency name and version
• Check GitHub Advisory Database for each dependency
• Record CVSS score and severity for each CVE found
• Verify whether the installed version is within the affected range

Trusted sources for CVE lookup (NFR-006):

• nvd.nist.gov (National Vulnerability Database)
• github.com/advisories (GitHub Advisory Database)
• npmjs.com (npm audit advisories)
• pypi.org (Python package index)
• crates.io (Rust crate registry)

If web research fails or is unavailable, record WARN: "Unable to verify CVEs via external source. Manual audit recommended."

Category 2: Abandoned/Unmaintained Packages (FR-048.2)

• Are any dependencies explicitly archived or deprecated?
• Have any dependencies had no commits or releases in the last 12 months?
• Are there deprecation notices in the package README or changelog?

Category 3: Unnecessary Dependencies (FR-048.3)

• Are all declared dependencies actually imported/used in the codebase?
• Do any dependencies duplicate functionality available in the language runtime?
• Do any dependencies overlap significantly with each other?

Category 4: License Compatibility (FR-048.4)

• Is the project's own license documented?
• Are all dependency licenses compatible with the project license?
• Are there any copyleft licenses (GPL, AGPL) in a permissively licensed project?
• Are there any dependencies with no license specified?

Category 5: Version Pinning (FR-048.5)

• Are dependencies pinned to exact versions or narrow ranges?
• Are floating ranges (^, ~, *, >=) used without a lockfile present?
• Is there a lockfile that pins transitive dependencies?

Category 6: Supply Chain Integrity (FR-048.6)

• Does a lockfile exist for the project's dependency manager?
• Does the lockfile include integrity hashes/checksums?
• Are dependencies sourced from official registries (not private/unknown sources)?

---

Severity Guidance (FR-049)

FAIL - Must fix before approval

• Known CVEs with CVSS score >= 7.0 (High or Critical severity)

WARN - Should address, does not block approval

• Known CVEs with CVSS score < 7.0 (Low or Medium severity)
• Abandoned or unmaintained packages (no activity in 12+ months)
• License compatibility concerns
• Missing lockfile or lockfile without checksums
• Unnecessary dependencies
• Floating version ranges without lockfile

N/A - Not applicable

Use N/A with justification when a category does not apply. Example justifications:

• "No dependency manifest found in this project"
• "Project has no runtime dependencies (standalone scripts)"
• "License check not applicable - internal/private project with no distribution"

---

Output Format

Write findings to the specified output path using the format below. Finding IDs use the DEP- prefix.

---
skill: review-deps
wp: <WP-ID>
spec: <spec-path>
reviewed_at: <ISO-8601-timestamp>
status: completed
finding_counts:
  pass: <count>
  warn: <count>
  fail: <count>
  na: <count>
files_reviewed:
  - package.json
  - package-lock.json
---

# review-deps Findings for <WP-ID>

## Summary

<Brief overview: dependency manifest analyzed, total dependencies, CVEs found, overall health assessment.>

## Findings

### DEP-001 [FAIL]
- **Checklist item**: Known CVEs - High severity
- **Requirement**: FR-048 category 1, FR-049
- **File**: package.json#L15
- **Description**: lodash@4.17.20 has CVE-2021-23337 (CVSS 7.2 - command injection via template).
- **Expected**: Upgrade to lodash@4.17.21 or later (patched).
- **Evidence**: NVD lookup confirmed affected versions: < 4.17.21.

### DEP-002 [WARN]
- **Checklist item**: Abandoned Package
- **Requirement**: FR-048 category 2
- **File**: package.json#L22
- **Description**: request@2.88.2 is deprecated. Last release was in 2020.
- **Expected**: Migrate to an actively maintained HTTP client (e.g., got, axios, undici).
- **Evidence**: NPM page shows "DEPRECATED" banner.

### DEP-003 [WARN]
- **Checklist item**: Version Pinning - Floating range
- **Requirement**: FR-048 category 5
- **File**: package.json#L18
- **Description**: express specified as "^4.18.0" (floating minor/patch).
- **Expected**: Use exact pin or ensure lockfile is committed.
- **Evidence**: package-lock.json exists and is committed - risk mitigated by lockfile.

### DEP-004 [N/A]
- **Checklist item**: License Compatibility
- **Justification**: Internal project with no distribution. License compatibility is not a concern.