What it does

Dependency Auditor is a comprehensive security and health check for your project's supply chain. It goes beyond simple vulnerability scanning by evaluating four critical dimensions: Known Advisories, Version Staleness, Maintenance Health, and License Compliance.

Why use this skill

Prompting an AI to "check my packages" often results in hallucinations or outdated information. This skill follows a rigorous developer workflow: it parses your actual lockfiles (ensuring transitive dependencies are included), utilizes native tools like npm audit or cargo audit, and cross-references live advisory databases (GHSA, OSV.dev). It identifies abandoned packages that haven't been updated in years and flags risky licenses (like AGPL) before they become a legal liability.

Supported Ecosystems

• JavaScript/TypeScript: npm, yarn, pnpm
• Python: pip, poetry, uv, Pipenv
• Rust: Cargo
• Go: Go Modules
• Java/Kotlin: Maven, Gradle
• Ruby: Bundler

The Output

The skill produces a prioritized remediation plan. Each finding includes the severity, the root cause (direct vs. transitive), a specific fix version, and an estimated effort score (trivial to high). You receive a clean summary and the exact commands needed to patch your environment immediately.