dependency-auditor
Audit dependencies for security, licenses, and health while generating a phased, low-risk upgrade and migration plan.
skill install https://www.promptspace.in/skills/dependency-auditorMaintain a Healthier, More Secure Codebase
Dependencies are the silent foundation of your application, but they can also be its greatest liability. Dependency Auditor is a specialized skill for senior engineers and DevOps professionals who need more than just a list of outdated packages. It provides a deep, multi-dimensional analysis of your project's ecosystem to identify risks before they reach production.
Detailed Risk Assessment
Unlike standard CLI tools, this skill analyzes five critical vectors:
- Security: Identifies CVEs and provides specific fixed versions.
- Maintenance Health: Flags abandoned packages, "bus factor" risks, and declining commit activity.
- License Compliance: Audits for copyleft (GPL/AGPL) or missing licenses that pose legal risks.
- Upgrade Risk: Categorizes updates by "Minor" (low risk) vs "Major" (migration required).
- Bundle Impact: Identifies heavy JavaScript packages and suggests lighter alternatives (e.g., swapping Moment.js for Day.js).
Actionable Migration Planning
The output isn't just a report; it’s a phased execution strategy. You receive a prioritized upgrade order—securing vulnerabilities first, then batching minor updates, and finally providing detailed migration steps for major version jumps, including breaking change analysis and required peer-dependency updates.
Supported Ecosystems
Supports npm, yarn, pnpm (JavaScript/TypeScript), pip, poetry (Python), Cargo (Rust), Go modules, Composer (PHP), and Bundler (Ruby).
Use cases
- Identify and remediate high-risk security vulnerabilities in package trees
- Ensure legal compliance by flags for incompatible open-source licenses
- Execute phased dependency upgrades to minimize breaking changes and downtime
- Assess library health metrics to replace unmaintained or deprecated packages
Example
Prompt
Sample output preview is available after purchase.
Known limitations
- Cannot execute shell commands (e.g., 'npm install') directly. - Vulnerability data may lag behind real-time databases if offline. - Indirect dependencies require a lock file for full visibility.