dependency-audit-assistant
Audit Dependencies for Security and Licenses
Projects accumulate vulnerabilities in dependencies over time. This skill audits packages for security issues, outdated versions, and license compliance across npm, pip, bundler, and go modules.
スキルZIPをダウンロード
Claudeでアップロード
設定 → 機能 → スキル → スキルをアップロードへ移動
オンにして利用開始
テストする
「dependency-audit-assistant」を使用しています。 Run a dependency audit on this project
期待される結果:
- Vulnerabilities: 3 High, 5 Moderate, 2 Low
- Outdated Packages: 12 (3 major updates available)
- License Issues: 2 packages with unknown licenses
- Top Priority: Update lodash@4.17.15 to fix prototype pollution (CVE-2020-8203)
- Command: npm install lodash@4.17.21
セキュリティ監査
低リスクThis is a legitimate dependency auditing skill consisting of documentation and a license-checking shell script. The script runs standard package manager commands (npm, pip, bundle, go) for license detection, which is appropriate for its stated purpose. No malicious behavior or data exfiltration detected.
リスク要因
⚙️ 外部コマンド (4)
⚡ スクリプトを含む (1)
📁 ファイルシステムへのアクセス (1)
品質スコア
作れるもの
Pre-release Security Checks
Run comprehensive audits before deploying to production. Identify critical vulnerabilities requiring immediate attention.
CI/CD Pipeline Integration
Audit dependencies during build processes. Generate reports for compliance and security documentation.
License Compliance Review
Identify GPL/AGPL dependencies that may conflict with project licensing. Find alternatives for problematic packages.
これらのプロンプトを試す
Run a dependency audit on this project. Check for vulnerabilities, outdated packages, and license issues.
Find all security vulnerabilities in the dependencies. Prioritize by severity and provide fix recommendations.
Check all dependency licenses. Flag any GPL, AGPL, or unknown licenses that may cause compliance issues.
Generate a complete dependency audit report including: vulnerability count by severity, outdated packages list, license summary, and prioritized action items with commands to run.
ベストプラクティス
- Run audits regularly, not just before releases
- Address critical and high vulnerabilities immediately
- Test all updates in staging before production deployment
- Document decisions about accepted risks or pinned versions
回避
- Ignoring low-severity vulnerabilities without assessment
- Updating major versions without reviewing changelogs
- Accepting unknown licenses without investigation
- Skipping audits due to time pressure