Dependency Awareness

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable, mix_audit). Load when adding, updating, or auditing project dependencies, wiring up CI supply-chain checks, or triaging CVEs in a lock file.

goldziher e32f1cd 997 B Updated

File contents

Audit dependencies before adding them. Prefer well-maintained, widely-used packages with active maintenance. Pin versions and commit lock files. Use language-specific audit tools in CI:

  • Rust: cargo audit, cargo deny (license + advisory policies)
  • Python: pip-audit, bandit (SAST)
  • JavaScript/TypeScript: npm audit, pnpm audit
  • Go: govulncheck
  • Ruby: bundler-audit
  • PHP: composer audit
  • Java: OWASP dependency-check Maven/Gradle plugin
  • C#: dotnet list package --vulnerable
  • Elixir: mix_audit Zero tolerance for critical/high CVEs. Automate dependency update PRs where possible.

goldziher/ai-rulez/tree/main/internal/builtins/universal/security/skills/dependency-awareness commit e32f1cd30a

Frequently asked questions

npx skillmds@latest add goldziher/dependency-awareness