Dependency Auditor
What You Get
- Vulnerability report with CVE IDs, CVSS scores, and fix recommendations
- License compliance audit (copyleft flags, conflicts, missing licenses)
- Prioritized upgrade plan with breaking change risk assessment
Philosophy
Dependencies are attack surface. Every transitive dependency is code you did not write, did not review, and may not maintain. Audit proactively, not after an incident.
Workflow: 5 Phases
Phase 1: Scan Dependencies
Detect the project's ecosystem(s) from lockfiles and manifests. A single project may use multiple ecosystems (e.g., Node frontend + Python backend). Identify:
- Direct dependencies and their versions
- Transitive dependency tree depth
- Pinned vs floating version specifiers
Phase 2: Vulnerability Check
Run ecosystem-specific audit commands. See vulnerability-scanning.md for per-language tools. For each vulnerability:
- CVE identifier and CVSS score
- Affected version range
- Whether a patched version exists
- Whether the vulnerable code path is reachable in this project
Phase 3: License Audit
Classify every dependency's license. See license-compliance.md for the taxonomy. Flag:
- Copyleft licenses in proprietary projects
- License conflicts between dependencies
- Dependencies with no declared license
- Dual-licensed packages where the commercial license applies
Phase 4: Detect Bloat
Identify dependencies that are:
- Unused (imported but never called)
- Duplicated (multiple versions of the same package)
- Oversized relative to their function (pulling in a framework for one utility)
- Replaceable with standard library equivalents
Phase 5: Upgrade Plan
For each actionable finding, produce:
- Priority (critical vuln > license issue > bloat)
- Recommended action (upgrade, replace, remove, pin)
- Breaking change risk for each upgrade
- Test commands to verify the upgrade
Polyglot Coverage
| Ecosystem |
Manifest |
Lockfile |
Audit Tool |
| JavaScript/TypeScript |
package.json |
package-lock.json, yarn.lock, pnpm-lock.yaml |
npm audit, yarn audit |
| Python |
pyproject.toml, requirements.txt |
poetry.lock, uv.lock |
pip-audit, safety |
| Go |
go.mod |
go.sum |
govulncheck |
| Rust |
Cargo.toml |
Cargo.lock |
cargo-audit |
| Ruby |
Gemfile |
Gemfile.lock |
bundler-audit |
| Elixir |
mix.exs |
mix.lock |
mix_audit, sobelow |
| Java/Kotlin |
pom.xml, build.gradle |
|
dependency-check |
Sub-files
| File |
Topic |
| vulnerability-scanning.md |
Per-language audit commands, CVSS, supply chain |
| license-compliance.md |
License classification, GPL contamination, SPDX |
1---2name: dependency-auditor3description: Multi-language dependency vulnerability scanning and license compliance auditing. TRIGGER when: user asks to audit dependencies, check for vulnerabilities, review licenses, detect outdated or bloated packages, or assess supply chain risk. DO NOT TRIGGER when: user is adding a specific dependency they have already chosen, or debugging a build failure unrelated to dependency versions.4---56# Dependency Auditor78## What You Get910- Vulnerability report with CVE IDs, CVSS scores, and fix recommendations11- License compliance audit (copyleft flags, conflicts, missing licenses)12- Prioritized upgrade plan with breaking change risk assessment1314## Philosophy1516Dependencies are attack surface. Every transitive dependency is code you did not write, did not review, and may not maintain. Audit proactively, not after an incident.1718## Workflow: 5 Phases1920### Phase 1: Scan Dependencies2122Detect the project's ecosystem(s) from lockfiles and manifests. A single project may use multiple ecosystems (e.g., Node frontend + Python backend). Identify:23- Direct dependencies and their versions24- Transitive dependency tree depth25- Pinned vs floating version specifiers2627### Phase 2: Vulnerability Check2829Run ecosystem-specific audit commands. See [vulnerability-scanning.md](vulnerability-scanning.md) for per-language tools. For each vulnerability:30- CVE identifier and CVSS score31- Affected version range32- Whether a patched version exists33- Whether the vulnerable code path is reachable in this project3435### Phase 3: License Audit3637Classify every dependency's license. See [license-compliance.md](license-compliance.md) for the taxonomy. Flag:38- Copyleft licenses in proprietary projects39- License conflicts between dependencies40- Dependencies with no declared license41- Dual-licensed packages where the commercial license applies4243### Phase 4: Detect Bloat4445Identify dependencies that are:46- Unused (imported but never called)47- Duplicated (multiple versions of the same package)48- Oversized relative to their function (pulling in a framework for one utility)49- Replaceable with standard library equivalents5051### Phase 5: Upgrade Plan5253For each actionable finding, produce:54- Priority (critical vuln > license issue > bloat)55- Recommended action (upgrade, replace, remove, pin)56- Breaking change risk for each upgrade57- Test commands to verify the upgrade5859## Polyglot Coverage6061| Ecosystem | Manifest | Lockfile | Audit Tool |62|-----------|----------|----------|------------|63| JavaScript/TypeScript | package.json | package-lock.json, yarn.lock, pnpm-lock.yaml | npm audit, yarn audit |64| Python | pyproject.toml, requirements.txt | poetry.lock, uv.lock | pip-audit, safety |65| Go | go.mod | go.sum | govulncheck |66| Rust | Cargo.toml | Cargo.lock | cargo-audit |67| Ruby | Gemfile | Gemfile.lock | bundler-audit |68| Elixir | mix.exs | mix.lock | mix_audit, sobelow |69| Java/Kotlin | pom.xml, build.gradle | | dependency-check |7071## Sub-files7273| File | Topic |74|------|-------|75| [vulnerability-scanning.md](vulnerability-scanning.md) | Per-language audit commands, CVSS, supply chain |76| [license-compliance.md](license-compliance.md) | License classification, GPL contamination, SPDX |
DROOdotFOO