dependency-audit
dependency-audit is a Claude Code skill that analyzes project dependencies across multiple ecosystems (npm, pip, Maven, Go, Cargo, etc.) to identify security vulnerabilities with CVE references, assess license compliance against organizational policies, flag outdated packages by risk priority, and analyze transitive dependency risks. Use this skill when tasked with auditing dependencies, reviewing package security posture, checking license compliance, assessing overall dependency health, or generating vulnerability reports with actionable remediation timelines.
git clone --depth 1 https://github.com/mohitagw15856/pm-claude-skills /tmp/dependency-audit && cp -r /tmp/dependency-audit/plugins/pm-engineering/skills/dependency-audit ~/.claude/skills/dependency-auditSKILL.md
# Dependency Audit Skill Produce a complete dependency audit report for a project — covering security vulnerabilities (with CVE references), license compliance against policy, outdated packages prioritised by risk, transitive dependency risk analysis, and a concrete remediation plan with timeline. A good dependency audit gives the team a clear, prioritised action list — not a raw dump of audit output that no one acts on. ## Required Inputs Ask for these if not already provided: - **Project language and ecosystem** — npm, pip/PyPI, Maven/Gradle, Go modules, Cargo, RubyGems, NuGet, or mixed - **Dependency list or package manifest** — paste the contents of `package.json`, `requirements.txt`, `go.mod`, `pom.xml`, etc., or provide the audit tool output - **License policy** — which licenses are allowed, which are restricted (e.g. "GPL is prohibited", "MIT/Apache/BSD only", or "no policy yet — recommend one") - **Current security tooling** — Dependabot, Snyk, OWASP Dependency-Check, npm audit, pip-audit, or none ## Output Format --- # Dependency Audit Report: [Project Name] **Ecosystem:** [npm / pip / Maven / Go / etc.] **Audit date:** [Date] **Auditor:** [Name] **Total direct dependencies:** [N] **Total transitive dependencies:** [N] **Audit tool(s) used:** [npm audit / pip-audit / Snyk / OWASP Dependency-Check / etc.] --- ## Executive Summary | Category | Finding | Risk level | |---|---|---| | Critical vulnerabilities | [N] CVEs requiring immediate action | [Critical / High / Low] | | High vulnerabilities | [N] CVEs — fix within 7 days | [High / Medium] | | License violations | [N] packages with non-compliant licenses | [High / Low] | | Severely outdated packages | [N] packages > 2 major versions behind | [Medium] | | Packages with no active maintenance | [N] packages — no commits in 12+ months | [Medium] | | **Overall dependency health score** | **[Score]/100** | **[Red / Amber / Green]** | **Scoring methodology:** Critical CVEs: −20 each. High CVEs: −10 each. License violations: −15 each. Abandoned packages: −5 each. Maximum deduction: 100. Score ≥80 = Green, 60–79 = Amber, <60 = Red. **Immediate actions required:** 1. [Most critical action — e.g. "Upgrade lodash from 4.17.11 to 4.17.21 to fix CVE-2021-23337 (Critical — prototype pollution)"] 2. [Second action] 3. [Third action] --- ## 1. Security Vulnerability Findings ### Critical and High Severity (Act within 24–72 hours) | Package | Installed version | Fix version | CVE | Severity | CVSS score | Description | Exploitability | |---|---|---|---|---|---|---|---| | [package-name] | [X.Y.Z] | [A.B.C] | [CVE-YYYY-NNNNN] | Critical | [9.x] | [e.g. Prototype pollution via `merge` function — remote code execution possible] | [Known exploit / PoC available / No known exploit] | | [package-name] | [X.Y.Z] | [A.B.C] | [CVE-YYYY-NNNNN] | High | [7.x] | [e.g. Path traversal in file serving utility] | [PoC available] | | [package-name] | [X.Y.Z] | [A.B.C] | [CVE-YYYY-NNNNN] | High | [7.x] | [e.g. Regular expression denial of service (ReDoS)] | [No known exploit] | ### Medium Severity (Fix within 30 days) | Package | Installed version | Fix version | CVE | Severity | CVSS score | Description | |---|---|---|---|---|---|---| | [package-name] | [X.Y.Z] | [A.B.C] | [CVE-YYYY-NNNNN] | Medium | [5.x] | [Description] | | [package-name] | [X.Y.Z] | [A.B.C] | [CVE-YYYY-NNNNN] | Medium | [4.x] | [Description] | ### Low Severity (Fix within 90 days or accept risk) | Package | Installed version | Fix version | CVE | Severity | Description | |---|---|---|---|---|---| | [package-name] | [X.Y.Z] | [A.B.C] | Low | [Description] | ### Vulnerabilities With No Fix Available | Package | CVE | Severity | Recommended mitigation | |---|---|---|---| | [package-name] | [CVE-YYYY-NNNNN] | [High] | [e.g. "Remove this package — alternative: [replacement]"] | | [package-name] | [CVE-YYYY-NNNNN] | [Medium] | [e.g. "Vendor has a fix in progress — track issue [URL]. Mitigate by [X]"] | --- ## 2. License Compliance Matrix ### License Policy Reference | License | Category | Policy | Notes | |---|---|---|---| | MIT | Permissive | Allowed | Attribution required in distributed products | | Apache 2.0 | Permissive | Allowed | Attribution + NOTICE file required | | BSD 2-Clause / 3-Clause | Permissive | Allowed | Attribution required | | ISC | Permissive | Allowed | | | MPL 2.0 | Weak copyleft | Allowed with review | Source disclosure required for modified MPL files only | | LGPL v2 / v3 | Weak copyleft | Allowed with review | Dynamic linking permitted; static linking may require disclosure | | GPL v2 / v3 | Strong copyleft | **Restricted** | May require open-sourcing the entire codebase — legal review required | | AGPL v3 | Strong copyleft | **Restricted** | Network use triggers copyleft — especially risky for SaaS | | SSPL | Source available | **Prohibited** | Not OSI-approved — treat as proprietary | | Proprietary / Commercial | Commercial | **Requires contract** | Verify license covers current use case and scale | | Unknown / Unlicensed | — | **Prohibited** | No license = all rights reserved — cannot use legally | ### Findings: Packages With Compliance Issues | Package | License | Issue | Recommendation | Risk if unaddressed | |---|---|---|---|---| | [package-name] | GPL v3 | Copyleft — may require open-sourcing this project | Replace with [alternative] or get legal sign-off | Legal / IP risk | | [package-name] | AGPL v3 | Network copyleft — SaaS use triggers disclosure | Replace with [alternative] | Legal / IP risk | | [package-name] | Proprietary | License may not cover current usage tier | Verify license scope with vendor | Contract breach | | [package-name] | Unknown | No license declared in package metadata | Contact maintainer or replace | Cannot use legally | ### All Licenses in Use (Full Inventory) | License | Package count | Compliance status | |---|---|---| | MIT | [N] | Compliant | | Apache 2.0 | [N] | Compliant | | BSD-3-Clause | [N] | Complian
Design a 360-degree feedback survey or write a structured 360 feedback report. Use when asked to build a 360 feedback process, write 360 feedback for a colleague, design a feedback survey, or produce a feedback report. Produces either a complete survey instrument with rating scales and open-ended questions, or a structured narrative feedback report with themes, strengths, and development areas.
Decode a 401k or workplace retirement plan — the real cost of its funds, the match's fine print, vesting math, and the plan features worth using or avoiding. Use when someone asks 'is my 401k any good', 'decode my 401k plan', 'which funds should I look at', or 'what fees am I paying'. Produces a fee decode in dollars-over-time, match and vesting math, a fund-lineup triage by cost, and the questions for HR or the plan administrator.
Design statistically rigorous A/B tests for product features, UI changes, onboarding flows, and pricing experiments. Use when asked to set up an experiment, design an A/B test, calculate sample size, or interpret test results. Produces a complete test plan with hypothesis, variant definitions, sample size, duration estimate, guardrail metrics, and a results interpretation guide.
Analyse a finished A/B test and write the readout — the result, whether it's statistically and practically significant, what it means, and the ship/no-ship call. Use when asked to analyse experiment results, write an A/B test readout, interpret test data, or decide whether to ship a variant. Produces a clear verdict with the lift and confidence, segment cuts, the risks (peeking, novelty, sample), and a recommendation. Distinct from planning a test — this reads results.
Generate a WCAG 2.2 accessibility audit checklist and remediation suggestions for any UI or design. Use when asked to audit for accessibility, check WCAG compliance, review a design for a11y issues, or create an accessibility remediation plan. Produces a prioritised checklist with pass/fail assessments and specific fixes.
Plan a trip that actually works with a disability or access need — confirm real accessibility (not just 'accessible' labels), book the assistance in advance, plan for equipment and medication, and build in the contingencies for when access breaks down. Use when someone says 'plan an accessible trip', 'travelling with a wheelchair/disability', 'book assistance for my flight', or 'will this hotel actually work for me'. Produces an access-verified itinerary, an assistance-booking checklist, an equipment/medication plan, and contingency scripts. Verify specifics with providers.
Request a reasonable accommodation at work or in education — frame it around the barrier and the adjustment (not your diagnosis), cite the right process, and navigate the back-and-forth constructively. Use when someone says 'I need a workplace accommodation', 'request reasonable adjustments', 'ADA/Equality Act accommodation', or 'how do I ask for accommodations for my disability/condition'. Produces the request letter, a barriers-and-adjustments map, disclosure guidance, and a plan for the interactive process. Not legal advice — routes to the formal process and to advocacy where needed.
Build a structured account plan for any key customer or target account. Use when asked to create an account plan, key account strategy, strategic account review, or territory plan. Produces a complete account plan with relationship map, growth opportunities, risks, and 90-day action plan.