Comprehensive Dependency Risk Analysis

Maintaining security and stability in a growing codebase is a constant struggle. This skill automates the tedious process of auditing your project's dependency tree, identifying everything from critical security vulnerabilities to unmaintained "ghost" packages. It provides a structured, multi-tier health report that helps developers prioritize maintenance tasks before they become technical debt.

What it does

The skill systematically scans your project to detect package managers, extract dependency versions, and cross-reference them against security advisories. It covers:

• Security Auditing: Identifies known CVEs and vulnerabilities using local ecosystem tools and internal reference tables.
• Maintenance Status: Flags deprecated packages or those that haven't seen an update in over 12 months.
• Version Drift: Detects when production dependencies are falling behind major or minor releases.
• Environment Integrity: Finds version conflicts across different manifests and identifies missing lockfiles.

Supported Ecosystems

This developer-centric tool is built to work across polyglot environments, supporting npm, yarn, pnpm (Node.js), pip, poetry (Python), Go modules, Cargo (Rust), Bundler (Ruby), and Maven (Java). Unlike basic prompting, this skill follows a deterministic classification framework to ensure your security findings are actionable and consistent.