Dependency Audit

Dependency Audit

When to Use

Use this skill when tasked with auditing dependencies, before adding new dependencies, or as part of a security review.

Procedure

1. Inventory All Dependencies

Node.js:

TARGET="${1:-~/workspace}"
cd "$TARGET"

echo "=== Direct Dependencies ==="
jq -r '.dependencies // {} | to_entries[] | "\(.key) \(.value)"' package.json

echo ""
echo "=== Dev Dependencies ==="
jq -r '.devDependencies // {} | to_entries[] | "\(.key) \(.value)"' package.json

echo ""
echo "=== Total dependency tree ==="
npm ls --all --depth=0 2>/dev/null | tail -n +2 | wc -l
echo "direct + transitive packages"

Python:

cd "$TARGET"

echo "=== requirements.txt ==="
cat requirements.txt 2>/dev/null

echo ""
echo "=== pyproject.toml dependencies ==="
python3 -c "
import tomllib, json
with open('pyproject.toml', 'rb') as f:
    data = tomllib.load(f)
deps = data.get('project', {}).get('dependencies', [])
for d in deps:
    print(d)
" 2>/dev/null

echo ""
echo "=== Installed packages ==="
pip list --format=columns 2>/dev/null | head -30

2. Check for Known Vulnerabilities

npm audit:

cd "$TARGET"

# Full JSON audit
npm audit --json 2>/dev/null | tee /tmp/npm-audit.json

# Summary
echo "=== Vulnerability Summary ==="
jq '.metadata.vulnerabilities' /tmp/npm-audit.json 2>/dev/null

# Critical and High details
echo "=== Critical/High Vulnerabilities ==="
jq '
  .vulnerabilities | to_entries[]
  | select(.value.severity == "critical" or .value.severity == "high")
  | {
      name: .key,
      severity: .value.severity,
      range: .value.range,
      fix_available: .value.fixAvailable,
      via: [.value.via[] | if type == "object" then .title else . end]
    }
' /tmp/npm-audit.json 2>/dev/null

pip audit:

cd "$TARGET"

pip audit --format=json 2>/dev/null | tee /tmp/pip-audit.json \
  || echo "pip-audit not installed. Install with: pip install pip-audit"

# Parse results
jq '.dependencies[] | select(.vulns | length > 0) | {
  name: .name,
  version: .version,
  vulns: [.vulns[] | {id: .id, fix_versions: .fix_versions}]
}' /tmp/pip-audit.json 2>/dev/null

3. Check for Outdated Dependencies

npm:

cd "$TARGET"

echo "=== Outdated Packages ==="
npm outdated --json 2>/dev/null | jq '
  to_entries[] | {
    package: .key,
    current: .value.current,
    wanted: .value.wanted,
    latest: .value.latest,
    behind: (if .value.current != .value.latest then "YES" else "no" end)
  }
' 2>/dev/null

pip:

cd "$TARGET"

echo "=== Outdated Packages ==="
pip list --outdated --format=columns 2>/dev/null

4. Evaluate Each Dependency

For each dependency, assess:

PACKAGE="express"

# npm: check package info
npm info "$PACKAGE" --json 2>/dev/null | jq '{
  name: .name,
  version: .version,
  license: .license,
  homepage: .homepage,
  maintainers: [.maintainers[].name],
  last_publish: .time[.version],
  weekly_downloads: .downloads
}' 2>/dev/null

# Check if it is maintained (last publish date)
LAST_PUBLISH=$(npm info "$PACKAGE" time --json 2>/dev/null | jq -r 'to_entries | sort_by(.value) | last | .value')
echo "Last published: $LAST_PUBLISH"

Evaluation criteria:

• Maintained? Last publish within 12 months
• Popular? Weekly downloads > 1000
• Secure? No unpatched CVEs
• Licensed? Compatible license (MIT, Apache-2.0, BSD are generally safe)
• Scoped? Does it request minimal permissions/capabilities

5. Check Licenses

cd "$TARGET"

# npm: license check
echo "=== License Inventory ==="
npm ls --json 2>/dev/null | jq '
  [.. | .license? // empty] | group_by(.) | map({license: .[0], count: length}) | sort_by(-.count)
' 2>/dev/null

# Flag problematic licenses
echo "=== Potentially Problematic Licenses ==="
npm ls --json 2>/dev/null | jq -r '
  [paths(type == "string" and (test("GPL|AGPL|SSPL|BUSL|Unlicense|UNKNOWN")))] as $paths
  | $paths[] | join("/")
' 2>/dev/null

6. Produce Audit Report

REPORT_FILE="/home/shared/dependency-audit-$(date +%Y%m%d).md"

cat > "$REPORT_FILE" <<'EOF'
# Dependency Audit Report

**Date:** YYYY-MM-DD
**Project:** [name]
**Package Manager:** npm / pip

## Summary
| Metric | Value |
|--------|-------|
| Total direct dependencies | N |
| Total transitive dependencies | N |
| Critical vulnerabilities | N |
| High vulnerabilities | N |
| Outdated packages | N |
| License concerns | N |

## Vulnerability Findings

| Package | Version | Latest | Severity | CVE | Fix Available |
|---------|---------|--------|----------|-----|---------------|
| ... | ... | ... | ... | ... | Yes/No |

## Outdated Dependencies

| Package | Current | Wanted | Latest | Risk |
|---------|---------|--------|--------|------|
| ... | ... | ... | ... | ... |

## License Review

| License | Count | Concern |
|---------|-------|---------|
| MIT | N | None |
| GPL-3.0 | N | Copyleft — review compatibility |

## Recommendations
1. [Specific action: "Upgrade express from 4.17.1 to 4.18.2 to fix CVE-XXXX-XXXXX"]
2. [Specific action: "Replace abandoned-pkg with maintained-alternative"]
EOF

# Register as artifact
bash /home/shared/scripts/artifact.sh register \
  --name "dependency-audit" \
  --type "report" \
  --path "$REPORT_FILE" \
  --description "Dependency audit report with vulnerabilities and license review"

Quality Checklist

• All direct and transitive dependencies inventoried
• npm audit / pip audit run and results parsed
• Outdated packages identified with current vs latest version
• Each critical/high vulnerability has a recommended fix
• Licenses reviewed for compatibility
• Report includes specific, actionable recommendations
• Report written to shared workspace and registered as artifact