# Dependency Checker

> Software Composition Analysis (SCA) for detecting vulnerable dependencies and license compliance

- Skill: `lodetomasi/dependency-checker` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lodetomasi/dependency-checker`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lodetomasi/dependency-checker/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: lodetomasi (https://skillmd.com/u/lodetomasi)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lodetomasi/dependency-checker

---


# Dependency Checker Skill

## Overview
Software Composition Analysis (SCA) skill for identifying vulnerable dependencies, outdated packages, and license compliance issues across multiple package managers and languages.

## Capabilities

### 1. Vulnerability Detection
- Known CVE detection in dependencies
- Transitive dependency analysis
- Severity assessment (Critical, High, Medium, Low)
- Exploit availability checking
- Patch availability verification

### 2. Dependency Management
- Outdated package identification
- Version conflict detection
- Breaking change alerts
- Update recommendations
- Lock file validation

### 3. License Compliance
- License compatibility checking
- GPL/LGPL contamination detection
- Commercial use restrictions
- Attribution requirements

### 4. Multi-Language Support
- **JavaScript/TypeScript**: npm, yarn, pnpm
- **Python**: pip, pipenv, poetry
- **Java**: Maven, Gradle
- **Ruby**: Bundler
- **Go**: go.mod
- **.NET**: NuGet
- **PHP**: Composer

## Tools Integration

### Snyk (Primary Tool)
Industry-leading SCA with AI-powered fix recommendations:

```bash
# Install Snyk
npm install -g snyk

# Authenticate
snyk auth

# Test for vulnerabilities
snyk test

# Monitor for new vulnerabilities
snyk monitor

# Fix vulnerabilities automatically
snyk fix
```

### GitHub Dependabot
Automated dependency updates:

```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
```

### npm audit (Built-in)
```bash
# Check vulnerabilities
npm audit

# Show detailed report
npm audit --json > audit-report.json

# Fix automatically
npm audit fix

# Force fix (may introduce breaking changes)
npm audit fix --force
```

### pip-audit (Python)
```bash
# Install
pip install pip-audit

# Scan dependencies
pip-audit

# Check specific requirements file
pip-audit -r requirements.txt

# Output JSON
pip-audit --format json > pip-audit.json
```

### OWASP Dependency-Check
Multi-language dependency scanner:

```bash
# Download
wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.0.0/dependency-check-8.0.0-release.zip

# Run scan
./dependency-check/bin/dependency-check.sh \
  --project "MyProject" \
  --scan ./src \
  --format ALL \
  --out ./reports
```

## Integration Scripts

### dependency_scan.sh
Automated multi-language dependency scanning:
```bash
#!/bin/bash
# Comprehensive dependency vulnerability scan

REPORT_DIR="security-reports/dependencies"
mkdir -p $REPORT_DIR

echo "=== Dependency Vulnerability Scan ==="

# 1. JavaScript/Node.js
if [ -f "package.json" ]; then
    echo "Scanning npm dependencies..."
    npm audit --json > $REPORT_DIR/npm-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan..."
        snyk test --json > $REPORT_DIR/snyk-npm.json || true
    fi
fi

# 2. Python
if [ -f "requirements.txt" ] || [ -f "Pipfile" ]; then
    echo "Scanning Python dependencies..."
    pip-audit --format json > $REPORT_DIR/pip-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Python)..."
        snyk test --file=requirements.txt --json > $REPORT_DIR/snyk-python.json || true
    fi
fi

# 3. Java
if [ -f "pom.xml" ]; then
    echo "Scanning Maven dependencies..."
    mvn dependency:tree > $REPORT_DIR/maven-tree.txt

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Java)..."
        snyk test --file=pom.xml --json > $REPORT_DIR/snyk-java.json || true
    fi
fi

# 4. OWASP Dependency Check
if command -v dependency-check &> /dev/null; then
    echo "Running OWASP Dependency Check..."
    dependency-check --project "MyProject" --scan . --format JSON \
      --out $REPORT_DIR/owasp-dependency-check.json
fi

echo "=== Scan Complete ==="
echo "Reports saved to: $REPORT_DIR/"
```

### analyze_dependencies.py
Parse and prioritize vulnerabilities:
```python
#!/usr/bin/env python3
import json
import sys
from collections import defaultdict

def analyze_npm_audit(json_file):
    """Analyze npm audit results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', {})

    findings = defaultdict(list)
    for pkg, vuln in vulnerabilities.items():
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': pkg,
            'severity': severity,
            'via': vuln.get('via', []),
            'range': vuln.get('range', ''),
            'fix_available': vuln.get('fixAvailable', False)
        })

    return findings

def analyze_snyk_results(json_file):
    """Analyze Snyk results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', [])

    findings = defaultdict(list)
    for vuln in vulnerabilities:
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': vuln.get('packageName'),
            'version': vuln.get('version'),
            'title': vuln.get('title'),
            'cve': vuln.get('identifiers', {}).get('CVE', []),
            'upgrade': vuln.get('upgradePath', []),
            'exploitMaturity': vuln.get('exploitMaturity', 'unknown')
        })

    return findings

def print_summary(npm_findings, snyk_findings):
    """Print combined summary"""
    print("=== Dependency Vulnerability Summary ===\n")

    all_findings = defaultdict(list)
    for severity in ['critical', 'high', 'medium', 'low']:
        all_findings[severity].extend(npm_findings.get(severity, []))
        all_findings[severity].extend(snyk_findings.get(severity, []))

    for severity in ['critical', 'high', 'medium', 'low']:
        findings = all_findings.get(severity, [])
        if findings:
            print(f"\n{severity.upper()}: {len(findings)} vulnerabilities")
            for finding in findings[:5]:  # Show first 5
                pkg = finding.get('package', 'Unknown')
                title = finding.get('title', 'No description')
                print(f"  • {pkg}: {title[:60]}...")

                if finding.get('fix_available'):
                    print(f"    ✓ Fix available")
                elif finding.get('upgrade'):
                    print(f"    ✓ Upgrade to: {finding['upgrade']}")

                if finding.get('cve'):
                    print(f"    🔗 CVE: {', '.join(finding['cve'][:2])}")

    # Calculate risk score
    score = (
        len(all_findings['critical']) * 10 +
        len(all_findings['high']) * 5 +
        len(all_findings['medium']) * 2 +
        len(all_findings['low']) * 1
    )
    print(f"\n=== Risk Score: {score} (Lower is better) ===")

    if score > 50:
        print("⚠️  HIGH RISK: Immediate action required")
    elif score > 20:
        print("⚠️  MEDIUM RISK: Address soon")
    else:
        print("✓ LOW RISK: Monitor and update regularly")

if __name__ == '__main__':
    npm_findings = analyze_npm_audit('security-reports/dependencies/npm-audit.json')
    snyk_findings = analyze_snyk_results('security-reports/dependencies/snyk-npm.json')
    print_summary(npm_findings, snyk_findings)
```

### update_dependencies.sh
Automated dependency updates:
```bash
#!/bin/bash
# Update dependencies with testing

echo "=== Dependency Update Process ==="

# 1. Create backup branch
git checkout -b dependency-update-$(date +%Y%m%d)

# 2. Update npm dependencies
if [ -f "package.json" ]; then
    echo "Updating npm dependencies..."
    npm update
    npm audit fix

    # Run tests
    echo "Running tests..."
    npm test
    if [ $? -ne 0 ]; then
        echo "❌ Tests failed after npm update"
        git checkout main
        exit 1
    fi
fi

# 3. Update Python dependencies
if [ -f "requirements.txt" ]; then
    echo "Updating Python dependencies..."
    pip list --outdated --format=json | \
      jq -r '.[] | "\(.name)==\(.latest_version)"' > requirements.new.txt

    # Test with new versions
    pip install -r requirements.new.txt
    pytest
    if [ $? -eq 0 ]; then
        mv requirements.new.txt requirements.txt
    else
        echo "❌ Tests failed after pip update"
        rm requirements.new.txt
        git checkout main
        exit 1
    fi
fi

# 4. Commit changes
git add package.json package-lock.json requirements.txt
git commit -m "chore: update dependencies

- Updated npm packages
- Updated Python packages
- All tests passing"

echo "✓ Dependencies updated successfully"
echo "Review changes and merge: git checkout main && git merge dependency-update-$(date +%Y%m%d)"
```

## Common Vulnerability Scenarios

### 1. Outdated Dependencies
```json
{
  "name": "lodash",
  "version": "4.17.15",  // Vulnerable
  "fix": "4.17.21"       // Patched
}
```

**Solution**:
```bash
npm update lodash
# Or specify version
npm install lodash@4.17.21
```

### 2. Transitive Dependencies
```
app (your code)
  └─ express@4.16.0
      └─ qs@6.5.2 (VULNERABLE!)
```

**Solution**:
```bash
# Force resolution (npm)
npm install qs@6.11.0

# Or use overrides in package.json
{
  "overrides": {
    "qs": "6.11.0"
  }
}
```

### 3. No Fix Available
```
⚠️  Prototype Pollution in lodash < 4.17.21
    No patch available for dependency tree
```

**Solution**:
- Find alternative package
- Vendor and patch manually
- Accept risk (with documentation)
- Refactor to remove dependency

## CI/CD Integration

### GitHub Actions with Dependabot
```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    labels:
      - "dependencies"
      - "security"
    reviewers:
      - "security-team"

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
```

### Snyk Monitoring
```yaml
name: Snyk Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
```

## License Compliance

### Check Licenses
```bash
# npm
npm install -g license-checker
license-checker --summary

# Python
pip install pip-licenses
pip-licenses --format=markdown > licenses.md

# Output incompatible licenses
license-checker --onlyAllow "MIT;Apache-2.0;BSD-3-Clause;ISC"
```

### Common License Issues
- **GPL**: Requires source code disclosure
- **AGPL**: Triggers on network use
- **LGPL**: Linking requirements
- **Commercial**: May require purchase

## Best Practices

1. **Automated Scanning**: Run on every commit
2. **Dependabot/Renovate**: Enable automatic PRs
3. **Version Pinning**: Use lock files (package-lock.json, Pipfile.lock)
4. **Regular Updates**: Weekly dependency updates
5. **Test Thoroughly**: Run full test suite after updates
6. **Security Alerts**: Configure notifications
7. **License Review**: Check before adding dependencies
8. **Minimal Dependencies**: Fewer deps = fewer vulnerabilities
9. **Audit New Packages**: Check reputation, maintenance
10. **Document Exceptions**: If can't upgrade, document why

## Vulnerability Remediation Priority

| Severity | CVSS Score | Exploitability | Timeline |
|----------|-----------|----------------|----------|
| Critical | 9.0-10.0  | Public exploit | Immediate (24h) |
| High     | 7.0-8.9   | Proof of concept | 7 days |
| Medium   | 4.0-6.9   | Theoretical | 30 days |
| Low      | 0.1-3.9   | Unlikely | 90 days |

## Requirements

```bash
# Snyk
npm install -g snyk

# npm audit (built-in with npm)

# Python
pip install pip-audit safety

# OWASP Dependency Check
wget https://github.com/jeremylong/DependencyCheck/releases/latest

# License checker
npm install -g license-checker
pip install pip-licenses
```

## Metrics to Track

- **Known vulnerabilities**: 0 critical, 0 high
- **Average age of dependencies**: < 6 months
- **Update frequency**: Weekly
- **Time to patch**: < 24h for critical
- **Dependency count**: Minimize
- **License compliance**: 100%
- **False positive rate**: < 5%