# Dependency Audit

> Skill: Dependency Audit

- Skill: `sawrus/dependency-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sawrus/dependency-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sawrus/dependency-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sawrus (https://skillmd.com/u/sawrus)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/sawrus/dependency-audit

---

# Skill: Dependency Audit

## When to load

When adding/updating dependencies, handling security findings, preparing releases, or reviewing supply-chain risk in PRs.

## Objective

Produce a dependency risk decision based on exploitability and business impact, not scanner output alone.

## Audit Workflow

1. **Inventory**
   - Identify direct and transitive dependencies changed in PR/release.
   - Record package source (registry), maintainer trust indicators, and version deltas.

2. **Scan**
   - Run ecosystem-native audit tools + repository policy checks.
   - Capture High/Critical findings with package path and affected components.

3. **Exploitability Triage**
   - Determine runtime reachability (is vulnerable code path invoked?).
   - Evaluate exposure (public endpoint, privileged process, internal-only).
   - Assess mitigations (WAF, sandbox, feature flags, auth boundaries).

4. **Classify each finding**
   - `exploitable-now` → block release, fix immediately.
   - `not-reachable` → document evidence and add VEX status.
   - `accepted-risk` → temporary exception with owner + expiry.

5. **Remediation Plan**
   - Prefer upgrade to patched version.
   - If upgrade is breaking: isolate vulnerability, add compensating controls, schedule upgrade milestone.

## Supply-Chain Red Flags

- Maintainer transfer shortly before suspicious release.
- Sudden dependency graph expansion unrelated to package purpose.
- install/postinstall scripts performing unexpected network activity.
- Obfuscated source in runtime package.
- Package source not in approved registries.

## Output Template (required)

- Dependency name and version delta
- Severity and advisory source
- Reachability evidence
- Classification (`exploitable-now` / `not-reachable` / `accepted-risk`)
- Decision and next action
- Owner and deadline