dependency-auditor
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
Security Assessment
About dependency-auditor
The 'dependency-auditor' skill helps developers maintain secure dependencies by automatically checking for known vulnerabilities in their project's dependencies. By auditing files such as 'package.json', 'requirements.txt', 'Gemfile', or 'pom.xml', this skill ensures that security risks, outdated packages, and other potential issues are identified before they can cause harm. It offers a proactive approach to managing dependencies, making it easier to avoid security vulnerabilities that might otherwise go unnoticed during development or deployment processes.
FAQ
How does the dependency auditor work?
The dependency auditor automatically checks dependencies in various project files for known vulnerabilities. It triggers on changes to dependency files or before deployments, running audits on package managers like npm, pip, bundler, and more. It categorizes issues by severity and suggests fixes, including package updates or alternative solutions.
What package managers are supported?
The skill supports multiple package managers across different programming languages, including npm, yarn, pnpm (Node.js), pip, pipenv, poetry (Python), bundler (Ruby), Maven, Gradle (Java), go modules (Go), and composer (PHP).
Can the dependency auditor be integrated into a CI/CD pipeline?
Yes, the dependency auditor can be integrated into a CI/CD pipeline. For example, it can be configured in GitHub Actions to block deployments if any high or critical vulnerabilities are detected in the project's dependencies.
Does this skill work in sandboxed environments?
Yes, the dependency auditor works without sandboxing and is fully compatible in typical development environments.
What actions can be taken to fix identified vulnerabilities?
The skill suggests various fix strategies, including automatic updates using commands like 'npm audit fix' for safe fixes or 'npm audit fix --force' for updates that may involve breaking changes. It also provides recommendations for manual updates and suggests alternative packages if necessary.
Install dependency-auditor
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
alirezarezvani/claude-code-tresor