Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Dependency Auditor

Read-only audit of dependency vulnerabilities, version health, and license facts across Node.js, Python, Go, Rust, JVM, and Ruby projects, with an evidence-backed report.

Security & ReviewIntermediate★ 805⑂ 84AI score 10/10Last updated: Aug 28, 2026

What it does

  • Discovers manifests and lockfiles (package.json, pnpm-lock.yaml, requirements*.txt, poetry.lock, go.mod, Cargo.lock, pom.xml, Gemfile.lock) and resolves the actually installed versions instead of trusting version ranges.
  • Runs only ecosystem-appropriate read-only commands: npm audit --json, pnpm audit, pip-audit, govulncheck -json ./..., cargo audit --json, go list -m -json all.
  • Requires per-finding evidence: advisory ID, source link, query timestamp, affected range, fixed version, direct/transitive and prod/dev scope, plus reachability proof (never guessed).
  • Produces a structured report: execution coverage, vulnerability table, version-health table, SPDX license facts, and open compliance questions — no legal conclusions.
  • Defaults to read-only; upgrades happen only after explicit authorization, in minimal batches with diff review, re-audit, tests, and rollback notes.

Who it's for

  • Developers doing supply-chain checks before a release
  • Platform/DevOps engineers maintaining polyglot monorepos
  • Security and compliance reviewers needing license due-diligence material
  • Anyone tired of LLMs hallucinating CVE IDs and fix versions

Examples

  1. "Audit this repo based on package-lock.json" → report with commands run, coverage gaps, and an advisory table.
  2. "Monorepo with Go and Rust — production dependencies only" → tool availability checked per ecosystem, with "not executed" reasons recorded rather than a false clean bill.
  3. "Approved: bump the two critical packages to patch releases" → minimal pinned upgrade, lockfile diff review, re-run audit/tests, residual risk and rollback documented.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/laolaoshiren/claude-code-skills-zh/HEAD/skills/dep-auditor/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the skills/dep-auditor folder from the GitHub repo laolaoshiren/claude-code-skills-zh into my ~/.claude/skills/dep-auditor/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/laolaoshiren/claude-code-skills-zh.git && mkdir -p ~/.claude/skills && cp -r claude-code-skills-zh/skills/dep-auditor ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repository: git clone https://github.com/laolaoshiren/claude-code-skills-zh.git
  3. Create the skills directory: mkdir -p ~/.claude/skills
  4. Copy this skill only: cp -r claude-code-skills-zh/skills/dep-auditor ~/.claude/skills/
  5. (Recommended) Pre-install scanners for better coverage: pip install pip-audit, go install golang.org/x/vuln/cmd/govulncheck@latest, cargo install cargo-audit.
  6. Start Claude Code inside your project and ask something like "audit my dependencies for vulnerabilities and produce a report".
  7. Review the report; if you want actual fixes, explicitly authorize the packages, version ranges, and branch to modify. Note the report template is authored in Chinese — ask for English output if needed.
View source on GitHub ↗License: MIT