Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill analyzing-dependenciesLoading…
Analyze project dependencies for known security vulnerabilities, outdated versions, and license compliance issues across multiple package ecosystems. This skill inspects npm, pip, Composer, Gem, Go module, and Cargo manifests and lock files, cross-references findings against CVE databases, and produces actionable remediation guidance with upgrade paths.
${CLAUDE_SKILL_DIR}/npm, pip/pip-audit, composer, gem, go, or cargo${CLAUDE_SKILL_DIR}/references/README.md${CLAUDE_SKILL_DIR}/ for manifest files: package.json and package-lock.json (npm/Node.js), requirements.txt/pyproject.toml/Pipfile.lock (Python), composer.json/composer.lock (PHP), Gemfile/Gemfile.lock (Ruby), go.mod/go.sum (Go), Cargo.toml/Cargo.lock (Rust).npm audit --json and parse the structured output. Map each advisory to its CVE identifier, CVSS score, severity level, vulnerable version range, and patched version.pip-audit --format=json or parse safety check --json output. Cross-reference each vulnerability against the OSV database for additional context.composer audit, bundle audit, cargo audit, govulncheck) and normalize the output to a common finding format.${CLAUDE_SKILL_DIR}/references/README.md.npm install package@version, pip install --upgrade package==version) prioritized by severity| Error | Cause | Solution |
|---|---|---|
npm audit returns exit code 1 | Vulnerabilities found (expected behavior) | Parse the JSON output normally; exit code 1 indicates findings, not a tool failure |
pip-audit not installed | Tool not available in the environment | Install with pip install pip-audit or fall back to manual pip list --outdated combined with OSV API queries |
| Lock file missing or outdated | Dependencies not properly locked | Run npm install, pip freeze, or equivalent to generate/update the lock file before scanning |
| Network timeout querying vulnerability DB | Firewall or connectivity issue | Retry with increased timeout; fall back to offline analysis of lock file versions against cached CVE data |
| Mixed ecosystem project | Multiple manifest files in one repo | Scan each ecosystem independently and combine results into a unified report |
| Private registry packages not found | Audit tools cannot resolve private packages | Skip private packages in the vulnerability scan; note them as "unverifiable" in the report |
Run npm audit --json in ${CLAUDE_SKILL_DIR}/. Parse the output to identify critical
and high severity advisories. For each, trace the dependency chain from direct
dependency to vulnerable package. Produce upgrade commands:
npm install [email protected] to resolve CVE-2024-XXXXX in path-to-regexp.
Flag any advisory without a fix available as requiring a workaround or alternative package.
Run pip-audit --format=json -r ${CLAUDE_SKILL_DIR}/requirements.txt. Map each
vulnerability to its CVE, CVSS score, and fixed version. For transitive
dependencies, identify the direct dependency pulling in the vulnerable package.
Recommend pinning to safe versions in requirements.txt and adding
pip-audit to the CI pipeline.
Extract licenses from ${CLAUDE_SKILL_DIR}/node_modules/ using license-checker --json
or equivalent. Flag any GPL-3.0 or AGPL-3.0 licensed package used in a
proprietary application as a license conflict. Flag packages with UNLICENSED
or missing license fields as requiring legal review before production use.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).