Skip to main content Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/thiagofernandes1987-create/APEX --skill dependency-auditor命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... test-inventory.json 9.7 KB name dependency-auditor description Use this skill when the task requires dependency auditor capabilities. executor HYBRID skill_id engineering.cs-engineering.dependency-auditor status ADOPTED security {"level":"standard","pii":false,"approval_required":false} anchors ["engineering"] tier 2 input_schema [{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true},{"name":"context","type":"string","description":"Additional context or background information","required":false}] output_schema [{"name":"result","type":"string","description":"Primary output from dependency auditor"}]
Dependency Auditor
Skill Type: POWERFULCategory: EngineeringDomain: Dependency Management & Security
Overview
The Dependency Auditor is a comprehensive toolkit for analyzing, auditing, and managing dependencies across multi-language software projects. This skill provides deep visibility into your project's dependency ecosystem, enabling teams to identify vulnerabilities, ensure license compliance, optimize dependency trees, and plan safe upgrades.
In modern software development, dependencies form complex webs that can introduce significant security, legal, and maintenance risks. A single project might have hundreds of direct and transitive dependencies, each potentially introducing vulnerabilities, license conflicts, or maintenance burden. This skill addresses these challenges through automated analysis and actionable recommendations.
Core Capabilities
1. Vulnerability Scanning & CVE Matching
Comprehensive Security Analysis
Scans dependencies against built-in vulnerability databases
Matches Common Vulnerabilities and Exposures (CVE) patterns
Identifies known security issues across multiple ecosystems
Analyzes transitive dependency vulnerabilities
Provides CVSS scores and exploit assessments
Tracks vulnerability disclosure timelines
Maps vulnerabilities to dependency paths
Multi-Language Support
JavaScript/Node.js : package.json, package-lock.json, yarn.lockPython : requirements.txt, pyproject.toml, Pipfile.lock, poetry.lockGo : go.mod, go.sumRust : Cargo.toml, Cargo.lockRuby : Gemfile, Gemfile.lockJava/Maven : pom.xml, gradle.lockfilePHP : composer.json, composer.lockC#/.NET : packages.config, project.assets.json
2. License Compliance & Legal Risk Assessment
License Classification System
Permissive Licenses : MIT, Apache 2.0, BSD (2-clause, 3-clause), ISCCopyleft (Strong) : GPL (v2, v3), AGPL (v3)Copyleft (Weak) : LGPL (v2.1, v3), MPL (v2.0)Proprietary : Commercial, custom, or restrictive licenses
Dual Licensed : Multi-license scenarios and compatibility
Unknown/Ambiguous : Missing or unclear licensing
Identifies incompatible license combinations
Warns about GPL contamination in permissive projects
Analyzes license inheritance through dependency chains
Provides compliance recommendations for distribution
Generates legal risk matrices for decision-making
3. Outdated Dependency Detection
Identifies dependencies with available updates
Categorizes updates by severity (patch, minor, major)
Detects pinned versions that may be outdated
Analyzes semantic versioning patterns
Identifies floating version specifiers
Tracks release frequencies and maintenance status
Maintenance Status Assessment
Identifies abandoned or unmaintained packages
Analyzes commit frequency and contributor activity
Tracks last release dates and security patch availability
Identifies packages with known end-of-life dates
Assesses upstream maintenance quality
4. Dependency Bloat Analysis Unused Dependency Detection
Identifies dependencies that aren't actually imported/used
Analyzes import statements and usage patterns
Detects redundant dependencies with overlapping functionality
Identifies oversized packages for simple use cases
Maps actual vs. declared dependency usage
Identifies multiple packages providing similar functionality
Detects version conflicts in transitive dependencies
Analyzes bundle size impact of dependencies
Identifies opportunities for dependency consolidation
Maps dependency overlap and duplication
5. Upgrade Path Planning & Breaking Change Risk Semantic Versioning Analysis
Analyzes semver patterns to predict breaking changes
Identifies safe upgrade paths (patch/minor versions)
Flags major version updates requiring attention
Tracks breaking changes across dependency updates
Provides rollback strategies for failed upgrades
Low Risk: Patch updates, security fixes
Medium Risk: Minor updates with new features
High Risk: Major version updates, API changes
Critical Risk: Dependencies with known breaking changes
Security patches: Highest priority
Bug fixes: High priority
Feature updates: Medium priority
Major rewrites: Planned priority
Deprecated features: Immediate attention
6. Supply Chain Security
Verifies package signatures and checksums
Analyzes package download sources and mirrors
Identifies suspicious or compromised packages
Tracks package ownership changes and maintainer shifts
Detects typosquatting and malicious packages
Maps complete dependency trees
Identifies high-risk transitive dependencies
Analyzes dependency depth and complexity
Tracks influence of indirect dependencies
Provides supply chain risk scoring
7. Lockfile Analysis & Deterministic Builds
Ensures lockfiles are up-to-date with manifests
Validates integrity hashes and version consistency
Identifies drift between environments
Analyzes lockfile conflicts and resolution strategies
Ensures deterministic, reproducible builds
Compares dependencies across environments (dev/staging/prod)
Identifies version mismatches between team members
Validates CI/CD environment consistency
Tracks dependency resolution differences
Technical Architecture
Scanner Engine (dep_scanner.py)
Multi-format parser supporting 8+ package ecosystems
Built-in vulnerability database with 500+ CVE patterns
Transitive dependency resolution from lockfiles
JSON and human-readable output formats
Configurable scanning depth and exclusion patterns
License Analyzer (license_checker.py)
License detection from package metadata and files
Compatibility matrix with 20+ license types
Conflict detection engine with remediation suggestions
Risk scoring based on distribution and usage context
Export capabilities for legal review
Upgrade Planner (upgrade_planner.py)
Semantic version analysis with breaking change prediction
Dependency ordering based on risk and interdependence
Migration checklists with testing recommendations
Rollback procedures for failed upgrades
Timeline estimation for upgrade cycles
Use Cases & Applications
Security Teams
Vulnerability Management : Continuous scanning for security issuesIncident Response : Rapid assessment of vulnerable dependenciesSupply Chain Monitoring : Tracking third-party security postureCompliance Reporting : Automated security compliance documentation
Legal & Compliance Teams
License Auditing : Comprehensive license compliance verificationRisk Assessment : Legal risk analysis for software distributionDue Diligence : Dependency licensing for M&A activitiesPolicy Enforcement : Automated license policy compliance
Development Teams
Dependency Hygiene : Regular cleanup of unused dependenciesUpgrade Planning : Strategic dependency update schedulingPerformance Optimization : Bundle size optimization through dep analysisTechnical Debt : Identifying and prioritizing dependency technical debt
DevOps & Platform Teams
Build Optimization : Faster builds through dependency optimizationSecurity Automation : Automated vulnerability scanning in CI/CDEnvironment Consistency : Ensuring consistent dependencies across environmentsRelease Management : Dependency-aware release planning
Integration Patterns
CI/CD Pipeline Integration
python dep_scanner.py /project --format json --fail-on-high
python license_checker.py /project --policy strict --format json
Scheduled Audits
./audit_dependencies.sh > weekly_report.html
python upgrade_planner.py deps.json --timeline 30days
Development Workflow
python dep_scanner.py . --quick-scan
python license_checker.py . --warn-conflicts
Advanced Features
Custom Vulnerability Databases
Support for internal/proprietary vulnerability feeds
Custom CVE pattern definitions
Organization-specific risk scoring
Integration with enterprise security tools
Policy-Based Scanning
Configurable license policies by project type
Custom risk thresholds and escalation rules
Automated policy enforcement and notifications
Exception management for approved violations
Reporting & Dashboards
Executive summaries for management
Technical reports for development teams
Trend analysis and dependency health metrics
Integration with project management tools
Multi-Project Analysis
Portfolio-level dependency analysis
Shared dependency impact analysis
Organization-wide license compliance
Cross-project vulnerability propagation
Best Practices
Scanning Frequency
Security Scans : Daily or on every commitLicense Audits : Weekly or monthlyUpgrade Planning : Monthly or quarterlyFull Dependency Audit : Quarterly
Risk Management
Prioritize Security : Address high/critical CVEs immediatelyLicense First : Ensure compliance before functionalityGradual Updates : Incremental dependency updatesTest Thoroughly : Comprehensive testing after updatesMonitor Continuously : Automated monitoring and alerting
Team Workflows
Security Champions : Designate dependency security ownersReview Process : Mandatory review for new dependenciesUpdate Cycles : Regular, scheduled dependency updatesDocumentation : Maintain dependency rationale and decisionsTraining : Regular team education on dependency security
Metrics & KPIs
Security Metrics
Mean Time to Patch (MTTP) for vulnerabilities
Number of high/critical vulnerabilities
Percentage of dependencies with known vulnerabilities
Security debt accumulation rate
Compliance Metrics
License compliance percentage
Number of license conflicts
Time to resolve compliance issues
Policy violation frequency
Maintenance Metrics
Percentage of up-to-date dependencies
Average dependency age
Number of abandoned dependencies
Upgrade success rate
Efficiency Metrics
Bundle size reduction percentage
Unused dependency elimination rate
Build time improvement
Developer productivity impact
Troubleshooting Guide
Common Issues
False Positives : Tuning vulnerability detection sensitivityLicense Ambiguity : Resolving unclear or multiple licensesBreaking Changes : Managing major version upgradesPerformance Impact : Optimizing scanning for large codebases
Resolution Strategies
Whitelist false positives with documentation
Contact maintainers for license clarification
Implement feature flags for risky upgrades
Use incremental scanning for large projects
Future Enhancements
Planned Features
Machine learning for vulnerability prediction
Automated dependency update pull requests
Integration with container image scanning
Real-time dependency monitoring dashboards
Natural language policy definition
Ecosystem Expansion
Additional language support (Swift, Kotlin, Dart)
Container and infrastructure dependencies
Development tool and build system dependencies
Cloud service and SaaS dependency tracking
Quick Start
python scripts/dep_scanner.py /path/to/project
python scripts/license_checker.py /path/to/project --policy strict
python scripts/upgrade_planner.py deps.json --risk-threshold medium
For detailed usage instructions, see README.md .
This skill provides comprehensive dependency management capabilities essential for maintaining secure, compliant, and efficient software projects. Regular use helps teams stay ahead of security threats, maintain legal compliance, and optimize their dependency ecosystems.
Why This Skill Exists Implement — Dependency Auditor
When to Use Use this skill when the task requires dependency auditor capabilities.
What If Fails If this skill fails to produce the expected output: (1) verify input completeness, (2) retry with more specific context, (3) fall back to the parent workflow without this skill.
Token-aware reasoning workflow with real tools: picks an operating mode to control cost, runs a structured pipeline (decompose → validate → verify → snapshot), and gives Claude Program-of-Thought, RK4/Euler, a code gate, and a safe skill router. Use when: multi-step or high-stakes tasks, real math, precise computation, audits, or the user mentions APEX, PoT, pipeline, or scientific mode.
thiagofernandes1987-create
thiagofernandes1987-create/APEX
打开 GitHub 仓库 