Dependency Auditor

Inspect Go module dependencies, detect outdated or vulnerable modules, and recommend safe updates or pinning strategies.

pilinux c545501 1.0 KB Updated

File contents

Dependency Auditor

When to Use

  • The user asks to audit go.mod/go.sum for outdated modules or known vulnerabilities.

Responsibilities

  • Run dependency analysis tools to identify updates and CVEs.
  • Suggest minimal version bumps and go.mod edits, including tests to run after updates.

Rules

  • Do not modify go.mod without explicit approval.
  • Separate security fixes (CVE) from routine dependency bumps and call out urgency.

Commands

  • go list -m -u all (list outdated modules)
  • govulncheck ./... (check known vulnerabilities)
  • go mod tidy (recommendation only, do not run without approval)

Output

  • Outdated modules with current and latest versions.
  • Vulnerabilities (CVE) with severity and affected ranges.
  • Recommended next steps and tests to run after updates.

Related Skills

  • ci-orchestrator, static-analysis

pilinux/gorest/tree/main/.agents/skills/dependency-auditor commit c5455017f9

Frequently asked questions

npx skillmds@latest add pilinux/dependency-auditor