| name | dependency-auditor |
| description | > Skill Type: POWERFUL > Category: Engineering > Domain: Dependency Management & Security. |
| zh_description | 用于dependency、审计，支持开发、调试、评审和交付。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | ["auditor", "dependency", "development"] |
| created_at | 2026-03-04 |
| updated_at | 2026-03-20 |
| quality | 5 |
| complexity | intermediate |
Dependency Auditor
Skill Type: POWERFUL
Category: Engineering
Domain: Dependency Management & Security
Overview
The Dependency Auditor is a comprehensive toolkit for analyzing, auditing, and managing dependencies across multi-language software projects. This skill provides deep visibility into your project's dependency ecosystem, enabling teams to identify vulnerabilities, ensure license compliance, optimize dependency trees, and plan safe upgrades.
In modern software development, dependencies form complex webs that can introduce significant security, legal, and maintenance risks. A single project might have hundreds of direct and transitive dependencies, each potentially introducing vulnerabilities, license conflicts, or maintenance burden. This skill addresses these challenges through automated analysis and actionable recommendations.
Core Capabilities
1. Vulnerability Scanning & CVE Matching
Comprehensive Security Analysis
- Scans dependencies against built-in vulnerability databases
- Matches Common Vulnerabilities and Exposures (CVE) patterns
- Identifies known security issues across multiple ecosystems
- Analyzes transitive dependency vulnerabilities
- Provides CVSS scores and exploit assessments
- Tracks vulnerability disclosure timelines
- Maps vulnerabilities to dependency paths
Multi-Language Support
- JavaScript/Node.js: package.json, package-lock.json, yarn.lock
- Python: requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock
- Go: go.mod, go.sum
- Rust: Cargo.toml, Cargo.lock
- Ruby: Gemfile, Gemfile.lock
- Java/Maven: pom.xml, gradle.lockfile
- PHP: composer.json, composer.lock
- C#/.NET: packages.config, project.assets.json
2. License Compliance & Legal Risk Assessment
License Classification System
- Permissive Licenses: MIT, Apache 2.0, BSD (2-clause, 3-clause), ISC
- Copyleft (Strong): GPL (v2, v3), AGPL (v3)
- Copyleft (Weak): LGPL (v2.1, v3), MPL (v2.0)
- Proprietary: Commercial, custom, or restrictive licenses
