| name | analyzing-dependencies |
| description | Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'. |
| version | 1.27.0 |
| allowed-tools | Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*) |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["security","audit","analyzing-dependencies"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Analyzing Dependencies
Overview
Analyze project dependencies for known security vulnerabilities, outdated
versions, and license compliance issues across multiple package ecosystems.
This skill inspects npm, pip, Composer, Gem, Go module, and Cargo manifests
and lock files, cross-references findings against CVE databases, and produces
actionable remediation guidance with upgrade paths.
Prerequisites
- Access to the target project directory and manifest files in
${CLAUDE_SKILL_DIR}/
- At least one package manager CLI available:
npm, pip/pip-audit, composer, gem, go, or cargo
- Network access for querying vulnerability databases (NVD, GitHub Advisory Database, OSV)
- Reference:
${CLAUDE_SKILL_DIR}/references/README.md for npm/pip audit report formats, license compatibility matrix, and dependency management best practices
Instructions
- Detect the project ecosystem by scanning
${CLAUDE_SKILL_DIR}/ for manifest files: package.json and package-lock.json (npm/Node.js), requirements.txt/pyproject.toml/Pipfile.lock (Python), composer.json/composer.lock (PHP), Gemfile/Gemfile.lock (Ruby), go.mod/go.sum (Go), Cargo.toml/Cargo.lock (Rust).
- For npm projects, run
npm audit --json and parse the structured output. Map each advisory to its CVE identifier, CVSS score, severity level, vulnerable version range, and patched version.
- For Python projects, run
pip-audit --format=json or parse safety check --json output. Cross-reference each vulnerability against the OSV database for additional context.
- For other ecosystems, run the equivalent audit command (
composer audit, bundle audit, cargo audit, govulncheck) and normalize the output to a common finding format.
- Analyze the dependency tree for transitive vulnerabilities -- identify which direct dependency pulls in the vulnerable transitive dependency, and whether upgrading the direct dependency resolves the issue.
