How do I install the Dependency Audit skill?

Run npx skillmds@latest add zebbern/dependency-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dependency Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dependency Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dependency Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dependency Audit?

zebbern (@zebbern) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dependency Audit by zebbern — Agent Skill

Name: Dependency Audit
Author: zebbern

File contents

Dependency Audit Skill

Procedures for auditing dependencies across ecosystems.

WHEN_TO_USE

Apply this skill when scanning for dependency vulnerabilities, checking license compliance, identifying outdated packages, or planning a dependency update strategy.

Vulnerability Scanning

Node.js

npm audit                          # Basic audit
npm audit --json                   # JSON output for parsing
npm audit fix                      # Auto-fix compatible updates
npm audit fix --force              # Force fix (may include breaking changes)
npx better-npm-audit audit         # Enhanced audit with severity filtering

Python

pip-audit                          # Scan installed packages
pip-audit -r requirements.txt      # Scan requirements file
pip-audit --format json            # JSON output
safety check                       # Alternative scanner

General Tools

npx snyk test                      # Snyk vulnerability scan
trivy fs .                         # Trivy filesystem scan
grype .                            # Grype vulnerability scan

License Compatibility

Permissive Licenses (generally safe)

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD

Copyleft Licenses (require review)

GPL-2.0, GPL-3.0 — require derivative work to be GPL-licensed.
LGPL-2.1, LGPL-3.0 — dynamic linking usually OK, static linking triggers copyleft.
AGPL-3.0 — network use triggers copyleft. Avoid in SaaS unless intentional.
MPL-2.0 — file-level copyleft. Modified files must stay MPL.

Compatibility Matrix

Your License	Can use MIT	Can use Apache	Can use GPL	Can use AGPL
MIT	Yes	Yes	No	No
Apache-2.0	Yes	Yes	No	No
GPL-3.0	Yes	Yes	Yes	No
AGPL-3.0	Yes	Yes	Yes	Yes

Check Commands

npx license-checker --summary      # Node.js license summary
npx license-checker --failOn "GPL" # Fail on GPL licenses
pip-licenses                        # Python license listing

Outdated Package Detection

npm outdated                        # Node.js outdated packages
pip list --outdated                  # Python outdated packages

Update Strategies

Patch updates (x.x.PATCH): Apply immediately. Low risk.
Minor updates (x.MINOR.x): Apply in batches. Test before merging.
Major updates (MAJOR.x.x): Treat as a migration. Review changelog, test thoroughly.

Process

Run audit to identify vulnerable/outdated packages.
Classify updates by risk (patch / minor / major).
Apply patch updates first, test.
Apply minor updates in batches, test.
Plan major updates as separate migration tasks.
Re-run audit to verify all issues resolved.

---name: dependency-auditdescription: Dependency auditing: vulnerability scanning, license compliance, outdated package detection, and update strategies. Use when checking or updating project dependencies.---# Dependency Audit SkillProcedures for auditing dependencies across ecosystems.## WHEN_TO_USEApply this skill when scanning for dependency vulnerabilities, checking license compliance, identifying outdated packages, or planning a dependency update strategy.## Vulnerability Scanning### Node.js```bashnpm audit # Basic auditnpm audit --json # JSON output for parsingnpm audit fix # Auto-fix compatible updatesnpm audit fix --force # Force fix (may include breaking changes)npx better-npm-audit audit # Enhanced audit with severity filtering```### Python```bashpip-audit # Scan installed packagespip-audit -r requirements.txt # Scan requirements filepip-audit --format json # JSON outputsafety check # Alternative scanner```### General Tools```bashnpx snyk test # Snyk vulnerability scantrivy fs . # Trivy filesystem scangrype . # Grype vulnerability scan```## License Compatibility### Permissive Licenses (generally safe)- MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD### Copyleft Licenses (require review)- GPL-2.0, GPL-3.0 — require derivative work to be GPL-licensed.- LGPL-2.1, LGPL-3.0 — dynamic linking usually OK, static linking triggers copyleft.- AGPL-3.0 — network use triggers copyleft. Avoid in SaaS unless intentional.- MPL-2.0 — file-level copyleft. Modified files must stay MPL.### Compatibility Matrix| Your License | Can use MIT | Can use Apache | Can use GPL | Can use AGPL ||-------------|-------------|----------------|-------------|--------------|| MIT | Yes | Yes | No | No || Apache-2.0 | Yes | Yes | No | No || GPL-3.0 | Yes | Yes | Yes | No || AGPL-3.0 | Yes | Yes | Yes | Yes |### Check Commands```bashnpx license-checker --summary # Node.js license summarynpx license-checker --failOn "GPL" # Fail on GPL licensespip-licenses # Python license listing```## Outdated Package Detection```bashnpm outdated # Node.js outdated packagespip list --outdated # Python outdated packages```## Update Strategies1. **Patch updates** (x.x.PATCH): Apply immediately. Low risk.2. **Minor updates** (x.MINOR.x): Apply in batches. Test before merging.3. **Major updates** (MAJOR.x.x): Treat as a migration. Review changelog, test thoroughly.### Process1. Run audit to identify vulnerable/outdated packages.2. Classify updates by risk (patch / minor / major).3. Apply patch updates first, test.4. Apply minor updates in batches, test.5. Plan major updates as separate migration tasks.6. Re-run audit to verify all issues resolved.

Frequently asked questions

Dependency Audit