perform-a-dependency-audit
Audit direct and transitive software dependencies for necessity, provenance, maintenance, security, license, compatibility, and upgrade risk. Use when performing release review, maintenance planning, incident response, or supply-chain hardening.
ソース情報
- リポジトリ
- protosphinx/sphinxstack
- ソースの最終更新活動
- 2026年7月29日 13:55
- 検出された SKILL.md の言語
- 英語
- スター
- 3
- フォーク
- 0
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
ファイルエクスプローラー
2 ファイルSKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- perform-a-dependency-audit
- category
- code
- description
- Audit direct and transitive software dependencies for necessity, provenance, maintenance, security, license, compatibility, and upgrade risk. Use when performing release review, maintenance planning, incident response, or supply-chain hardening.
# perform-a-dependency-audit
Produce an actionable inventory rather than a raw scanner dump. Evaluate whether the application actually
reaches the risky component and what a safe remediation would change.
## Inputs
- Gather manifests, lockfiles, build files, containers, generated clients, vendored code, and deployed artifacts.
- Record runtime, development, optional, platform, and transitive dependency paths.
- Use current authoritative advisories, license data, project releases, and maintenance signals.
## Procedure
1. Generate a reproducible dependency and provenance inventory from the built artifact.
2. Identify unpinned, unverified, duplicated, abandoned, unexpected, or unnecessary packages.
3. Map each dependency to purpose, owner, execution context, privilege, data access, and update path.
4. Check advisories and supported versions, recording source and date.
5. Assess reachability and exploit preconditions instead of ranking only by published severity.
6. Review license, export, platform, compatibility, and maintenance constraints with responsible owners.
7. Prioritize remove, replace, upgrade, isolate, accept, or investigate decisions.
8. Plan upgrades with release notes, migration work, tests, lockfile diff, and rollback.
9. Verify the rebuilt artifact contains the intended versions and no unexpected additions.
10. Save exceptions with risk owner, compensating control, expiry, and review trigger.
## Boundaries
Do not publish private dependency graphs, exploit details, or internal exposure without approval. Never auto-upgrade
production dependencies solely from scanner output. Preserve lockfiles and generated artifacts needed for a
reproducible review.
## Done
- The inventory reconciles manifests, lockfiles, transitive paths, and the deployed artifact
- Findings include reachability, context, evidence source, and remediation choice
- Planned changes have compatibility tests, owners, rollback, and verification
- Accepted risks and false positives have dated evidence and review triggers
GitHubで見る