How do I install the Dependency Audit skill?

Run npx skillmds@latest add acaprino/dependency-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dependency Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dependency Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dependency Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dependency Audit?

acaprino (@acaprino) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dependency Audit by acaprino — Agent Skill

Name: Dependency Audit
Author: acaprino

Dependency Audit

Knowledge base for the evidence-first method: the per-ecosystem tool matrix, the obligations analysis model, and the verifiable signal catalog. TRIGGER WHEN: auditing dependencies for vulnerabilities, license obligations, outdated packages, or supply-chain risk in any ecosystem; loaded by the /dependency-audit:deps-audit command. DO NOT TRIGGER WHEN: dead-code or unused-dependency cleanup (use senior-review:code-review or typescript-development:knip), Python-only lint/type audits (use python-development:python-audit), or code-level security review (use senior-review:security-auditor).

acaprino 9d638e3 4 files · 16.9 KB Updated Sep 17, 2026

File contents

Dependency Audit Knowledge Base

Method for auditing third-party dependencies without inventing facts. The /dependency-audit:deps-audit command orchestrates; this skill holds the depth, split into references loaded on demand.

Core principles

Tool-first. The audit runs the ecosystem's own tooling and reads registries and advisory databases (OSV, GitHub Advisories, RustSec, PyPA). It never re-implements a scanner in pseudo-code and never guesses what a tool would have said.
Evidence tiers. Every reported fact is TOOL-REPORTED, INFERRED (with the derivation stated), or UNKNOWN (with what would resolve it). Fabricated quantities of any kind are forbidden: no estimated hours, no invented percentages, no dollar figures.
Non-destructive remediation. Never --force, never unapproved major-version upgrades, never lockfile regeneration, never dependency replacement without first presenting the proposed change, its compatibility risk, and a test/rollback plan.
Licenses are obligations, not a matrix. License analysis asks what obligations a dependency's license imposes given how the project combines and distributes it. Binary "X is incompatible with Y" tables are wrong often enough to be banned.
Honest coverage. Missing tools and unreachable registries are reported as gaps, with install commands, instead of being papered over.

References

File	Load when
`references/ecosystems.md`	Selecting or running audit / outdated / license tooling for any ecosystem, or parsing its output
`references/license-analysis.md`	Writing any license finding, classifying an SPDX identifier, or answering a copyleft question
`references/supply-chain.md`	Evaluating supply-chain risk signals or reviewing a dependency diff for tampering

---name: dependency-auditdescription: Knowledge base for the evidence-first method: the per-ecosystem tool matrix, the obligations analysis model, and the verifiable signal catalog. TRIGGER WHEN: auditing dependencies for vulnerabilities, license obligations, outdated packages, or supply-chain risk in any ecosystem; loaded by the /dependency-audit:deps-audit command. DO NOT TRIGGER WHEN: dead-code or unused-dependency cleanup (use senior-review:code-review or typescript-development:knip), Python-only lint/type audits (use python-development:python-audit), or code-level security review (use senior-review:security-auditor).---# Dependency Audit Knowledge BaseMethod for auditing third-party dependencies without inventing facts. The `/dependency-audit:deps-audit` command orchestrates; this skill holds the depth, split into references loaded on demand.## Core principles1. **Tool-first.** The audit runs the ecosystem's own tooling and reads registries and advisory databases (OSV, GitHub Advisories, RustSec, PyPA). It never re-implements a scanner in pseudo-code and never guesses what a tool would have said.2. **Evidence tiers.** Every reported fact is `TOOL-REPORTED`, `INFERRED` (with the derivation stated), or `UNKNOWN` (with what would resolve it). Fabricated quantities of any kind are forbidden: no estimated hours, no invented percentages, no dollar figures.3. **Non-destructive remediation.** Never `--force`, never unapproved major-version upgrades, never lockfile regeneration, never dependency replacement without first presenting the proposed change, its compatibility risk, and a test/rollback plan.4. **Licenses are obligations, not a matrix.** License analysis asks what obligations a dependency's license imposes given how the project combines and distributes it. Binary "X is incompatible with Y" tables are wrong often enough to be banned.5. **Honest coverage.** Missing tools and unreachable registries are reported as gaps, with install commands, instead of being papered over.## References| File | Load when ||---|---|| `references/ecosystems.md` | Selecting or running audit / outdated / license tooling for any ecosystem, or parsing its output || `references/license-analysis.md` | Writing any license finding, classifying an SPDX identifier, or answering a copyleft question || `references/supply-chain.md` | Evaluating supply-chain risk signals or reviewing a dependency diff for tampering |

Frequently asked questions