Cfn Dep Audit

CFN Dependency Audit

Purpose: Enforce the two dependency policies from CLAUDE.md and code-quality.md:

1. ~90-day cooldown on NEW dependencies. A new dependency is the last rung of the build ladder (YAGNI to reuse to stdlib to native to installed-dep to one line to minimum new code to NEW dep). When a dep is genuinely new, pin it with a ~90-day supply-chain cooldown, then move forward progressively.
2. CVE carve-out: take CVE fixes immediately. The cooldown is overridden by a security patch. Known-vulnerability fixes ship now, no waiting.

This is the supply-chain counterpart to cfn-security-review. It does not read your code; it reasons about what you depend on. Findings route through cfn-vote-implement. This skill never auto-installs or auto-upgrades.

What It Checks

"Newly added" means added in the staged diff (--cached), or failing that the last commit (HEAD~1), of package.json / Cargo.toml.

For npm, "newly added" is computed structurally: the dependency key set (dependencies, devDependencies, peerDependencies, optionalDependencies) of the current package.json is diffed against the base ref (lib/npm-new-deps.sh). A scripts entry, formatting change, or any non-dependency key can never be flagged as a new package. Dependency gates diff structured dependency keys — never raw file lines.

Graceful Degradation

Every check is best-effort. If a tool is missing or the network is unavailable, that check is skipped and listed under "checks skipped", not failed. The script always reports which checks actually ran so you know your coverage. With no package.json and no Cargo.toml, it exits clean with "nothing to audit".

Severity Model

• CVE findings = high, immediate. Tagged block in the manifest. The cooldown does not apply to them. Treat as merge blockers.
• Cooldown violations = warn. Tagged cooldown. A new dep under the threshold is a caution, not a hard block. Wait out the cooldown or justify an override.
• Age unknown = info. Registry offline or package not found. Surfaced so a human verifies manually.

Inputs

• CFN_DEP_COOLDOWN_DAYS (env, default 90): cooldown window in days.

Outputs

• Summary to stdout (checks ran/skipped, CVE count, cooldown count).
• When findings are actionable: a manifest at <project-root>/.cfn-cache/manifests/cfn-dep-audit-<ns>.json in the shared cfn-vote-implement schema (auto-gitignored, nanosecond-precision filename).
• When no findings: a plain report, no manifest.

Usage

$HOME/.claude/skills/cfn-dep-audit/execute.sh
CFN_DEP_COOLDOWN_DAYS=120 ./.claude/skills/cfn-dep-audit/execute.sh

# route any findings through voting
/cfn-vote-implement latest

Manifest Schema (shared with cfn-vote-implement)

{
  "review_id": "dep-audit-<ns>",
  "source": "cfn-dep-audit",
  "generated_at": "ISO-8601",
  "cooldown_days": 90,
  "suggestions": [
    {
      "id": "S001",
      "category": "cve | cooldown",
      "tag": "block | cooldown | info",
      "one_liner": "lodash: npm audit: high severity advisory",
      "title": "cve: lodash",
      "description": "npm audit: high severity advisory",
      "files": ["package.json or Cargo.toml"],
      "impact": "high | medium | low",
      "effort": "low",
      "suggested_approach": "Apply the fix now. CVE fixes are exempt from the cooldown.",
      "related_suggestions": []
    }
  ]
}

Rules

• Never auto-install, auto-upgrade, or modify a manifest file. Route through /cfn-vote-implement.
• A NEW dependency is the last rung of the build ladder. Trivial functionality (a few lines) must not pull a dep. The cooldown buys time for supply-chain attacks to surface.
• Security carve-out: never hand-roll crypto, auth, token/JWT parsing, or input sanitization to dodge a dep. A widely-audited dep wins there, cooldown or not.
• CVE fixes override the cooldown. Take them immediately.

Related

• cfn-arch - the build ladder (YAGNI to NEW dep) that decides whether a dep is even warranted.
• cfn-tech-debt - tracks cfn: shortcut markers, including "added dep, revisit" notes.
• /cfn-vote-implement - votes on and routes the findings.
• cfn-security-review - the code-level security gate (this skill is the dependency-level gate).