DA
Dependency Audit
🔵 Stable🕐 updated 2026-06-08
🔷 SkillSpec L3
pm-engineering
Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.
What to give it
▸Project language and ecosystem — npm, pip/PyPI, Maven/Gradle, Go modules, Cargo, RubyGems, NuGet, or mixed
▸Dependency list or package manifest — paste the contents of `package.json`, `requirements.txt`, `go.mod`, `pom.xml`, etc., or provide the audit tool output
▸License policy — which licenses are allowed, which are restricted (e.g. "GPL is prohibited", "MIT/Apache/BSD only", or "no policy yet — recommend one")
▸Current security tooling — Dependabot, Snyk, OWASP Dependency-Check, npm audit, pip-audit, or none
✅ The bar it holds itself to
Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.
✓Every Critical and High CVE has a named owner and a resolution date in the 30-day plan
✓License findings have been reviewed by legal or a named engineer with authority to accept the risk
✓Transitive dependency vulnerabilities are included — not just direct dependencies
✓Abandoned packages have a concrete replacement recommendation, not just "consider replacing"
✓CI pipeline change is included — the audit findings should be the last time these are caught manually
✓The dependency health score is calculated from actual findings, not estimated
✓Remediation plan actions are specific commands or steps, not "upgrade package X" without version targets
⚠️ What it refuses to do
Do not report only direct dependencies — transitive dependency vulnerabilities are often more dangerous and are the most commonly missed
Do not present raw audit tool output without interpretation — a table of 200 CVEs with no prioritisation is worse than no audit at all
Do not assign all Critical CVEs as "fix immediately" without checking whether an exploitable path exists in your usage context
Do not make license compliance decisions without legal input — flagging a GPL dependency without a recommendation is incomplete work
Do not complete the audit without including a CI/CD pipeline step — a one-time audit that leaves the door open for new vulnerabilities is not a remediation
Install
npx pm-claude-skills add --agent claude # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcpStart with
Related skills
🔌 Embed this skill
Drop this on your blog, docs, or site — it renders a "Run this skill" card:
<div data-pm-skill="dependency-audit"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>💬 Discussion
Dependency Audit is one of 1078 open-source professional AI agent skills — all SkillSpec L3.
Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog