Dependency Auditor

What it does

The Dependency Auditor skill automatically analyzes your project's code dependencies to identify potential security vulnerabilities and ensure a clean, maintainable codebase. It checks for known Common Vulnerabilities and Exposures (CVEs), outdated packages with available security fixes, malicious packages, license compatibility issues, and deprecated packages. The tool supports various package managers across multiple programming languages.

When to use it

This skill is useful in the following scenarios:

• Whenever package.json, requirements.txt, Gemfile, or pom.xml files are modified.
• Before deploying code changes to production environments.
• When you suspect vulnerabilities exist within your project's dependencies.
• After installing new packages using a package manager.

Key capabilities

• Vulnerability Scanning: Detects known CVEs, malicious packages, and license compatibility issues.
• Package Manager Support: Works with Node.js (npm, yarn, pnpm), Python (pip, pipenv, poetry), Ruby (bundler), Java (Maven, Gradle), Go (go modules), and PHP (composer).
• Severity Classification: Categorizes vulnerabilities as CRITICAL, HIGH, MEDIUM, or LOW based on their potential impact.
• Automated Fix Suggestions: Provides recommendations for updating vulnerable packages, including both safe automatic fixes and options that may introduce breaking changes.
• Automatic Actions: Detects package managers, runs security audit commands, parses results, categorizes vulnerabilities, suggests fixes, and flags breaking changes.

Example prompts

• "Run a dependency audit on my project."
• "Check for vulnerabilities in my requirements.txt file."
• "What dependencies have known security issues?"

Tips & gotchas

• The skill automatically runs audits when certain files are modified, but you can also trigger it manually.
• Be aware that using --force with automatic fix commands (e.g., npm audit fix --force) may introduce breaking changes to your project.
• Review the suggested fixes carefully before applying them, especially for critical vulnerabilities.