eddieran Dependency Auditor
Use this skill when the user needs a dependency audit that balances security, licensing, and upgrade risk.
Agent Compatibility
- Claude Code: supported
- Codex: supported
Inputs
- Dependency manifests and lockfiles
- Runtime context when a package is only used in tests or local tooling
- Policy constraints such as approved licenses or frozen release branches
Workflow
- Identify the package manager and lockfile state for each ecosystem.
- Separate direct dependencies from transitive risk when possible.
- Flag vulnerabilities, unsupported packages, and stale pins.
- Call out license conflicts or unclear license metadata.
- Recommend the smallest safe upgrade plan with likely blast radius.
Output Contract
- High-priority risks first
- Package name, version, and why it matters
- Suggested remediation path
- Notes on lockfile drift or missing lockfiles
Guardrails
- Do not recommend broad upgrades without naming the likely compatibility risk.
- Distinguish runtime dependencies from developer-only tooling.
- Prefer concrete remediation steps over generic “upgrade everything” advice.