Automated summary
This skill guides a security audit of a project's dependencies: known vulnerabilities, license compliance, outdated packages, and a remediation plan.
Strengths
- Covers both direct and transitive dependencies
- Produces a structured report with risks, fixes, and follow-up tasks
- Builds in safeguards: no public disclosure of vulnerabilities and staging validation before production
- Prioritizes fixes by severity and exposure
Limitations
- Names no specific scanning tool, deferring to an external playbook not included here
- No real automation: fixes remain recommendations to apply manually
- Useless without a dependency manifest file
Use it when you need to audit project dependencies for vulnerabilities, licensing problems, or outdated packages before shipping to production.
Avoid it when the project has no dependency manifests or when you cannot change or update dependencies.
Security analysis
SafeThe skill is purely instructional text about dependency auditing. It declares no tools, contains no commands, scripts, network calls, or file operations, and explicitly recommends verification in staging and avoiding disclosure of vulnerability details. Nothing here could be executed destructively or exfiltrate data, so listing it poses no meaningful execution risk.
No concerns found
How this analysis is madeExamples
Audit this project's dependencies for known vulnerabilities, license issues, and outdated packages, then give me a prioritized remediation plan.Review my package.json dependencies and propose safe upgrade paths with compatibility notes and staging validation steps.Check my direct and transitive dependencies for supply-chain risks and tell me which ones to fix first based on severity and exposure.name: codebase-cleanup-deps-audit description: "You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies." risk: unknown source: community date_added: "2026-02-27"
Dependency Audit and Security Analysis
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Use this skill when
- Auditing dependencies for vulnerabilities
- Checking license compliance or supply-chain risks
- Identifying outdated packages and upgrade paths
- Preparing security reports or remediation plans
Do not use this skill when
- The project has no dependency manifests
- You cannot change or update dependencies
- The task is unrelated to dependency management
Context
The user needs comprehensive dependency analysis to identify security vulnerabilities, licensing conflicts, and maintenance risks in their project dependencies. Focus on actionable insights with automated fixes where possible.
Requirements
$ARGUMENTS
Instructions
- Inventory direct and transitive dependencies.
- Run vulnerability and license scans.
- Prioritize fixes by severity and exposure.
- Propose upgrades with compatibility notes.
- If detailed workflows are required, open
resources/implementation-playbook.md.
Safety
- Do not publish sensitive vulnerability details to public channels.
- Verify upgrades in staging before production rollout.
Output Format
- Dependency summary and risk overview
- Vulnerabilities and license issues
- Recommended upgrades and mitigations
- Assumptions and follow-up tasks
Resources
resources/implementation-playbook.mdfor detailed tooling and templates.
Privacy Policy & Terms Generator
Security
Generate GDPR-compliant privacy policies and terms of service.
OWASP Security Checklist
Security
Generates application security checklists based on the OWASP Top 10.
Threat Model Generator
Security
Generates threat model documents with STRIDE analysis.