메뉴
Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Design or review REST and GraphQL API interfaces. Use when asked to design an API, review endpoint structure, define request/response schemas, or improve API ergonomics.
Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
Design, build, or debug data processing pipelines. Use when asked to process a dataset, transform data, build an ETL pipeline, schedule batch jobs, or fix data quality issues.
Safely run database schema migrations. Use when asked to update database schema, add columns, create tables, run alembic, or apply Django migrations.
Execute a structured deployment to staging or production. Use when asked to deploy, ship, release, push to production, or promote to staging.
Write or update technical documentation for code, APIs, or systems. Use when asked to document a module, write a README, generate API docs, or update existing documentation.
| name | dependency-audit |
| description | Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size. |
| license | MIT |
| compatibility | Requires pip or npm/yarn/pnpm |
Identify the package manager. Look for:
requirements.txt / pyproject.toml / Pipfile → Python (pip/uv)package.json → Node.js (npm/yarn/pnpm)go.mod → GoCargo.toml → RustRun vulnerability scan.
pip audit or uvx pip-auditnpm audit or npx better-npm-audit auditgovulncheck ./...Check for outdated packages.
pip list --outdatednpm outdatedLicense audit. Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:
uvx pip-licenses --order=licensenpx license-checker --summaryIdentify unused dependencies.
grep -r "import <package>" src/npx depcheckWrite the report as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).
| Excuse | Rebuttal |
|---|---|
| "We'll update dependencies later" | Known vulnerabilities are actively exploited. Flag them now. |
| "It's a dev dependency, it doesn't matter" | Dev dependencies run in CI and on developer machines — they are attack surface. |
| "Removing unused deps might break something" | If nothing imports it, nothing uses it. Remove it. |