perform-a-dependency-audit
Audit direct and transitive software dependencies for necessity, provenance, maintenance, security, license, compatibility, and upgrade risk. Use when performing release review, maintenance planning, incident response, or supply-chain hardening.
소스 정보
- 저장소
- protosphinx/sphinxstack
- 최근 소스 활동
- 2026년 7월 29일 13:55
- 감지된 SKILL.md 언어
- 영어
- 스타
- 3
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
2 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- perform-a-dependency-audit
- category
- code
- description
- Audit direct and transitive software dependencies for necessity, provenance, maintenance, security, license, compatibility, and upgrade risk. Use when performing release review, maintenance planning, incident response, or supply-chain hardening.
# perform-a-dependency-audit
Produce an actionable inventory rather than a raw scanner dump. Evaluate whether the application actually
reaches the risky component and what a safe remediation would change.
## Inputs
- Gather manifests, lockfiles, build files, containers, generated clients, vendored code, and deployed artifacts.
- Record runtime, development, optional, platform, and transitive dependency paths.
- Use current authoritative advisories, license data, project releases, and maintenance signals.
## Procedure
1. Generate a reproducible dependency and provenance inventory from the built artifact.
2. Identify unpinned, unverified, duplicated, abandoned, unexpected, or unnecessary packages.
3. Map each dependency to purpose, owner, execution context, privilege, data access, and update path.
4. Check advisories and supported versions, recording source and date.
5. Assess reachability and exploit preconditions instead of ranking only by published severity.
6. Review license, export, platform, compatibility, and maintenance constraints with responsible owners.
7. Prioritize remove, replace, upgrade, isolate, accept, or investigate decisions.
8. Plan upgrades with release notes, migration work, tests, lockfile diff, and rollback.
9. Verify the rebuilt artifact contains the intended versions and no unexpected additions.
10. Save exceptions with risk owner, compensating control, expiry, and review trigger.
## Boundaries
Do not publish private dependency graphs, exploit details, or internal exposure without approval. Never auto-upgrade
production dependencies solely from scanner output. Preserve lockfiles and generated artifacts needed for a
reproducible review.
## Done
- The inventory reconciles manifests, lockfiles, transitive paths, and the deployed artifact
- Findings include reachability, context, evidence source, and remediation choice
- Planned changes have compatibility tests, owners, rollback, and verification
- Accepted risks and false positives have dated evidence and review triggers
GitHub에서 보기