Dependency vulnerability auditor

The problem

Dependency audits usually return a wall of version numbers without actual risk context. Developers often miss legal landmines like copyleft licenses or supply-chain red flags that haven't triggered a CVE yet.

What it does

• Analyzes package.json, requirements.txt, Gemfile, and go.mod files for security gaps.
• Identifies license contamination risks, specifically flagging AGPL/GPL dependencies in commercial projects.
• Detects supply-chain red flags such as typosquatting patterns and suspicious postinstall scripts.
• Prioritizes vulnerabilities based on reachability and fix availability rather than just severity scores.

Frameworks & tools

Supports Node.js (npm, yarn, pnpm), Python (pip, poetry), Ruby (Bundler), and Go. Integrates with osv-scanner, npm audit, and pip-audit output.

Why this beats prompting it yourself

General LLMs often hallucinate CVE numbers or provide outdated vulnerability data. This skill follows a strict protocol to use authoritative local tools and focuses on structural risks, like license shifts and mutable git dependencies, that basic prompts overlook.

Use cases

• Reviewing a pull request that adds new, unfamiliar third-party packages.
• Performing a license compliance sweep before a commercial product release.
• Investigating suspicious package behavior or potential typosquatting.
• Hardening supply-chain security by moving from branch-based to SHA-based pins.

Known limitations

Cannot perform live registry lookups. Analysis accuracy is significantly lower if a lockfile is not provided alongside the manifest.