# Dependency Auditor

> Inspect Go module dependencies, detect outdated or vulnerable modules, and recommend safe updates or pinning strategies.

- Skill: `pilinux/dependency-auditor` (Agent Skill)
- Install (CLI): `npx skillmds@latest add pilinux/dependency-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pilinux/dependency-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: pilinux (https://skillmd.com/u/pilinux)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pilinux/dependency-auditor

---


# Dependency Auditor

## When to Use

- The user asks to audit `go.mod`/`go.sum` for outdated modules or known vulnerabilities.

## Responsibilities

- Run dependency analysis tools to identify updates and CVEs.
- Suggest minimal version bumps and `go.mod` edits, including tests to run after updates.

## Rules

- Do not modify `go.mod` without explicit approval.
- Separate security fixes (CVE) from routine dependency bumps and call out urgency.

## Commands

- `go list -m -u all` (list outdated modules)
- `govulncheck ./...` (check known vulnerabilities)
- `go mod tidy` (recommendation only, do not run without approval)

## Output

- Outdated modules with current and latest versions.
- Vulnerabilities (CVE) with severity and affected ranges.
- Recommended next steps and tests to run after updates.

## Related Skills

- `ci-orchestrator`, `static-analysis`