Dependency.audit

dependency.audit

Purpose

Audit project dependencies (npm, Python, Rust) for security vulnerabilities, outdated versions, and license compliance. Generates actionable recommendations for upgrades.

When to Use

Trigger Patterns:

• "Check for vulnerable dependencies"
• "Audit npm packages"
• "Find outdated Python dependencies"
• "Check dependency licenses"
• CI/CD security scanning

Do NOT Use When:

• Installing/upgrading packages (this is audit-only)
• Modifying lockfiles

Allowed Tools

• bash - Run npm audit, pip-audit, cargo audit
• read_file - Read package.json, pyproject.toml, Cargo.toml
• python - Parse results and generate reports

Access Level: 3 (Network-Enabled - checks package registries)

Network Access:

• npmjs.com (npm audit)
• pypi.org (pip audit)
• crates.io (cargo audit)

Expected I/O

Input:

• Package manager to audit: npm | pip | cargo | all
• Severity threshold: low | moderate | high | critical

Output:

• Security audit report
• License compliance report
• Upgrade recommendations
• Risk assessment

Dependencies

Required:

• npm (for npm audit)
• pip-audit (for Python)
• cargo-audit (for Rust, optional)

Configuration:

• config.json - Allowed licenses, severity thresholds
• allowlist.json - Exceptions for known-safe vulnerabilities

Examples

Example: Security Audit

User: "Check for vulnerable dependencies"

Output:

🔍 Dependency Security Audit

📦 NPM Packages:
  ❌ CRITICAL: vite@4.5.0 - CVE-2024-12345
     Description: Path traversal vulnerability
     Upgrade to: vite@5.0.10
     Impact: High

  ⚠️  MODERATE: react-dom@18.2.0 - CVE-2024-67890
     Description: XSS in dev mode
     Upgrade to: react-dom@18.3.1
     Impact: Low (dev-only)

🐍 Python Packages:
  ✅ All packages secure

Summary:
- Critical: 1
- Moderate: 1
- Low: 0
- Total packages scanned: 47

Recommendations:
1. Upgrade vite immediately (critical vulnerability)
2. Schedule react-dom upgrade (low risk, dev-only)

Example: License Check

User: "Check dependency licenses"

Output:

📜 License Compliance Report

✅ Allowed Licenses (45 packages):
   - MIT: 32 packages
   - Apache-2.0: 10 packages
   - BSD-3-Clause: 3 packages

⚠️  Review Required (2 packages):
   - package-x@1.0.0: GPL-3.0 (copyleft license)
   - package-y@2.1.0: Custom license (needs review)

❌ Disallowed Licenses (0 packages):
   - None found

Summary: 45 compliant, 2 need review, 0 violations

Limitations

• Requires network access to check registries
• Cannot auto-update packages (manual review required)
• Allowlist exceptions require human approval

Validation Criteria

• ✅ All critical vulnerabilities identified
• ✅ License compliance checked
• ✅ Upgrade paths suggested
• ✅ Risk assessment included

Maintenance

Owner: Platform Team Review Cycle: Quarterly Last Updated: 2025-10-18 Version: 1.0.0