Dependency Auditor

What it does

The borghei-dependency-auditor skill analyzes project dependencies to identify potential security vulnerabilities and outdated packages. It provides a report detailing these issues, allowing users to proactively address risks within their software projects. This helps maintain code quality and reduces the likelihood of exploitable weaknesses.

When to use it

• Security Audits: Before deploying an application or integrating new components, assess dependencies for known vulnerabilities.
• Maintenance Tasks: Regularly check project dependencies as part of routine maintenance to ensure they remain secure and up-to-date.
• Dependency Updates: Prioritize updates based on the severity of identified vulnerabilities.
• New Project Setup: Evaluate dependencies early in a project's lifecycle to establish a strong security foundation.

Key capabilities

• Vulnerability scanning of project dependencies.
• Identification of outdated packages.
• Generation of reports detailing potential issues.

Example prompts

• "Audit the dependencies for my Python project located at [GitHub repository URL]."
• "Check for vulnerabilities in the Node.js dependencies of this project: [project directory path]"
• “Generate a report on outdated packages in my Go module file.”

Tips & gotchas

The skill requires access to the codebase or dependency manifest (e.g., package.json, requirements.txt, go.mod) to perform its analysis. The accuracy of the audit depends on the completeness and correctness of the project's dependency information.