📦
code-style-enforcer
78Enforce Project Code Style
Teams lose time when code follows different local habits. This skill reviews files against project conventions and recommends consistent style improvements.
Coding & Development View
Skills dependency-audit-assistant
📦
dependency-audit-assistant
Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access🌐 Network access
Audit Dependencies for Security Risk
Dependency risks are hard to prioritize across package managers and license rules. This skill guides Claude, Codex, and Claude Code through practical audits with clear remediation steps.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "dependency-audit-assistant" from https://skillstore.io/skills/crazydubya-dependency-audit-assistant.md and its manifest at https://skillstore.io/api/skills/crazydubya-dependency-audit-assistant/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "dependency-audit-assistant". Audit this Node.js project before release.
Expected outcome:
A prioritized report listing critical and high vulnerabilities first, affected packages, safe upgrade paths, and commands that require approval.
Using "dependency-audit-assistant". Check whether our dependencies are safe for a proprietary SaaS product.
Expected outcome:
A license summary that separates permissive licenses from GPL, AGPL, unknown, and custom licenses, with legal-review notes.
Using "dependency-audit-assistant". Tell me which dependency updates are safe this sprint.
Expected outcome:
An update plan grouped into patch updates, minor updates, major updates, and packages that need migration research.
Security Audit
Medium Riskv10 • 7/9/2026 Open versioned report
Most static findings are false positives from reference documentation or markdown command examples. The real risks are the executable helper script, predictable /tmp/licenses.json usage, and automatic installation of external license tools.
4
Files scanned
1,099
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Automatic Global Tool Installation
The helper script installs missing tools with npm install -g, pip install, and go install before running license checks. This can change the user environment and fetch code from external package registries without a separate confirmation step.
The install commands are explicit and run when tools are missing. The behavior is useful for setup but has real supply-chain and environment-modification impact.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Unix shell invocation
#!/bin/bash
This is an executable shell script that runs package-manager and license-auditing commands. The behavior is aligned with the skill purpose, but it creates real local execution risk and should require user consent.
Medium
Temp directory access
npx license-checker --json > /tmp/licenses.json
The script uses a predictable shared path, /tmp/licenses.json, for intermediate output. This can cause file clobbering or symlink race issues on shared systems.
Medium
Temp directory access
jq -r 'to_entries[] | .value.licenses' /tmp/licenses.json | sort | uniq -c | sort -rn
The script uses a predictable shared path, /tmp/licenses.json, for intermediate output. This can cause file clobbering or symlink race issues on shared systems.
Medium
Temp directory access
jq -r 'to_entries[] | select(.value.licenses | contains("GPL")) | "\(.key): \(.value.licenses)"' /tm
The script uses a predictable shared path, /tmp/licenses.json, for intermediate output. This can cause file clobbering or symlink race issues on shared systems.
Medium
Temp directory access
jq -r 'to_entries[] | select(.value.licenses == "UNKNOWN" or .value.licenses == "") | .key' /tmp/lic
The script uses a predictable shared path, /tmp/licenses.json, for intermediate output. This can cause file clobbering or symlink race issues on shared systems.
Medium
Temp directory access
rm /tmp/licenses.json
The script uses a predictable shared path, /tmp/licenses.json, for intermediate output. This can cause file clobbering or symlink race issues on shared systems.
Risk Factors
⚙️ External commands (50)
reference/common-vulnerabilities.md:23 scripts/check-licenses.sh:117 scripts/check-licenses.sh:1 SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:36 SKILL.md:39 SKILL.md:40 SKILL.md:43 SKILL.md:46 SKILL.md:49 SKILL.md:57 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:66 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:100 SKILL.md:103 SKILL.md:104 SKILL.md:105 SKILL.md:106 SKILL.md:129 SKILL.md:130 SKILL.md:131 SKILL.md:132 SKILL.md:159-166 SKILL.md:166-169 SKILL.md:169-176 SKILL.md:176-179 SKILL.md:179-185 SKILL.md:185-194 SKILL.md:194 SKILL.md:210-238 SKILL.md:238-272
📁 Filesystem access (18)
reference/common-vulnerabilities.md:32 reference/common-vulnerabilities.md:74 scripts/check-licenses.sh:44 scripts/check-licenses.sh:50 scripts/check-licenses.sh:79 scripts/check-licenses.sh:85 scripts/check-licenses.sh:104 scripts/check-licenses.sh:110 scripts/check-licenses.sh:119 scripts/check-licenses.sh:128 scripts/check-licenses.sh:134 scripts/check-licenses.sh:139 scripts/check-licenses.sh:143 scripts/check-licenses.sh:56 scripts/check-licenses.sh:63 scripts/check-licenses.sh:67 scripts/check-licenses.sh:71 scripts/check-licenses.sh:73
🌐 Network access (1)
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/crazydubya-dependency-audit-assistant/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/crazydubya-dependency-audit-assistant?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/crazydubya-dependency-audit-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazydubya-dependency-audit-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/crazydubya-dependency-audit-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CrazyDubya. (2026). dependency-audit-assistant security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazydubya-dependency-audit-assistant/audits/10BibTeX citation
@techreport{crazydubya-crazydubya-dependency-audit-assistant-2026,
author = {CrazyDubya},
title = {dependency-audit-assistant security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/crazydubya-dependency-audit-assistant/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dependency-audit-assistant security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "CrazyDubya"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/crazydubya-dependency-audit-assistant/audits/10"
identifiers:
- type: other
value: "skillstore:crazydubya-dependency-audit-assistant:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Pre-release dependency review
Run a structured audit before shipping a release and prioritize fixes by severity and exposure.
Open source license screening
Identify dependencies with GPL, AGPL, unknown, or custom licenses before adding them to a product.
Maintenance backlog planning
Group outdated packages by patch, minor, and major update effort for safer dependency maintenance.
Try These Prompts
Run a basic dependency audit
Audit this project for dependency vulnerabilities and outdated packages. Start with read-only checks and summarize the highest priority fixes.
Check license compliance
Review dependency licenses in this project. Flag GPL, AGPL, unknown, unlicensed, and custom licenses, then suggest safe alternatives where possible.
Prioritize vulnerability remediation
Analyze the dependency audit results and rank fixes by severity, exploitability, production exposure, and update risk.
Create a release readiness report
Detect all package managers in this repository, audit vulnerabilities and licenses, identify risky transitive dependencies, and produce a release readiness report.
Best Practices
- Run read-only audit commands before any update or fix command.
- Review production dependencies and direct dependencies before lower-risk development-only findings.
- Test dependency updates in staging and keep lock files committed.
Avoid
- Do not run force update commands without explicit user approval.
- Do not treat license guidance as legal advice for commercial decisions.
- Do not ignore transitive dependencies because they are not listed directly.
Frequently Asked Questions
Does this skill automatically fix vulnerable packages?
No. It can recommend fix commands, but modifying dependencies should require explicit user approval.
Which package managers does it cover?
It covers common JavaScript, Python, Ruby, Java, Go, Rust, and PHP package managers.
Can it review licenses?
Yes. It identifies permissive, weak copyleft, strong copyleft, unknown, and unlicensed dependency risks.
Is it a replacement for Snyk or Dependabot?
No. It helps interpret audit results and plan remediation, but it relies on package tools and advisory data.
Can it prove a CVE affects my application?
Not by itself. It can help assess exposure, but runtime usage and application context still need review.
Can Claude Code use this skill?
Yes. The skill declares support for Claude, Codex, and Claude Code workflows.
Developer Details
Author
CrazyDubyaLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
Maintenance freshness
7/18/2026
Usage
3 downloads · 200 views
File structure
More from CrazyDubya
View all📦
docker-optimizer
78Optimize Dockerfiles for Production
Dockerfiles often grow large, insecure, and slow to rebuild. This skill helps Claude, Codex, or Claude Code review containers and propose practical optimizations.
DevOps & Infrastructure View
📦
accessibility-auditor
78Audit Web Accessibility Faster
Accessibility defects can block users and delay release reviews. This skill guides Claude, Codex, and Claude Code through WCAG-focused checks and practical fixes.
Coding & Development View
📦
api-documentation-generator
78Generate OpenAPI Docs from API Routes
Manual API docs get stale when routes change. This skill reads route files and builds OpenAPI or Swagger specs for common REST frameworks.
Documentation View
📦
performance-profiler
78Find Performance Bottlenecks in Code
Slow applications are hard to improve without a clear list of bottlenecks. This skill reviews code for query, algorithm, memory, frontend, network, and profiling issues.
Coding & Development View
📦
database-migration-helper
78Create Database Migrations Safely
Database migrations can break applications when file names, rollback logic, or ORM conventions are wrong. This skill helps Claude, Codex, and Claude Code create convention-aligned migrations with rollback guidance.
Coding & Development View
Related Skills
View all📦
security-analyzer
80Analyze Project Security Risks
by Cornjebus
Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.
Security & Compliance View
📦
sharp-edges
79Identify Risky APIs and Configurations
by sickn33
Risky APIs and unsafe defaults can hide reliability and security problems. This skill guides focused review of dangerous usage patterns and configuration choices.
Security & Compliance View
📦
security-gate
79Review Security Before Release
by DanielPodolsky
Teams miss security issues when release checks are informal. This skill guides Claude, Codex, and Claude Code through structured security questions and warning templates.
Security & Compliance View
📦
security-sentinel
79Audit Code for Security Risks
by Barnhardt-Enterprises-Inc
Security-sensitive code is easy to ship with hidden flaws in authentication, input handling, and secrets. This skill gives Claude, Codex, and Claude Code structured security references and scanner guidance for safer reviews.
Security & Compliance View
📦
stride-analysis-patterns
78Apply STRIDE Threat Modeling Patterns
by wshobson
Security reviews often miss threats when teams rely on informal checklists. This skill gives Claude, Codex, and Claude Code structured STRIDE templates for consistent threat identification.
Security & Compliance View
📦
security-review
78Review Web App Security Before Release
by sickn33
Security issues often appear when teams add authentication, APIs, payments, uploads, or sensitive data flows. This skill provides a focused checklist and review prompts for finding common web application risks before deployment.
Security & Compliance View