Multi-ecosystem dependency security auditor for Claude Code. Signal over noise — filters out the garbage that makes developers ignore
npm audit.
npm audit reports 47 vulnerabilities. You panic. Then you realize 38 are in dev dependencies, 4 are in transitive deps you never call, and 2 are disputed. Only 3 actually matter. But you just wasted 30 minutes figuring that out.
This is the #1 developer pain point with dependency auditing.
This skill runs real audit tools across all your ecosystems, then classifies every finding into four categories:
| Category | Meaning | Action |
|---|---|---|
| CRITICAL-RUNTIME | Vuln in production dep, reachable code path | Fix immediately |
| DEV-ONLY | Vuln in devDependency / test tooling | Log, deprioritize |
| TRANSITIVE-UNREACHABLE | Vulnerable function not called in dep chain | Acknowledge, monitor |
| DISPUTED/WITHDRAWN | CVE disputed or advisory withdrawn | Skip |
mkdir -p ~/.claude/skills/dependency-auditor
cp SKILL.md ~/.claude/skills/dependency-auditor/SKILL.md# Full security audit
> audit my deps
# License compliance check
> check licenses, we're MIT
# Monorepo phantom dependency scan
> scan our pnpm monorepo for phantom deps
# Generate SBOM
> generate an SBOM for this project
| Ecosystem | Audit Tool | Lockfile |
|---|---|---|
| Node.js | npm audit, yarn audit, pnpm audit |
package-lock.json, yarn.lock, pnpm-lock.yaml |
| Python | pip-audit, safety |
requirements.txt, pyproject.toml, Pipfile |
| Rust | cargo audit |
Cargo.lock |
| Go | govulncheck |
go.sum |
| Ruby | bundle-audit |
Gemfile.lock |
| Java/JVM | Maven/Gradle plugins | pom.xml, build.gradle |
| PHP | composer audit |
composer.lock |
Falls back to manifest parsing + GitHub Advisory Database if CLI tools aren't installed.
Runs real tools, classifies every finding, outputs a project Risk Score (1-10).
For critical findings: generates fix command, dry-runs it, applies on confirmation, runs tests to verify. Reverts if tests fail.
Detects GPL/AGPL contamination in permissive projects, unknown licenses, and license bait-and-switch between versions.
CycloneDX or SPDX format with component details, licenses, vulnerability cross-references.
Shows days-behind for each dependency plus maintenance status (Active, Maintenance, Deprecated, Abandoned, Archived).
Phantom dependency detection, version conflict reporting, cross-package vulnerability tracking.
Generates GitHub Actions workflow for weekly audits + PR-triggered checks on lockfile changes.
Risk Score: 5/10
3 actionable findings (filtered from 47 raw):
1. CRITICAL-RUNTIME: axios 0.21.1 — SSRF (CVE-2023-45857)
→ npm install axios@1.6.0
2. CRITICAL-RUNTIME: cryptography 41.0.3 — padding oracle (CVE-2024-26130)
→ pip install cryptography>=42.0.0
3. DEV-ONLY: semver 7.5.3 — ReDoS (CVE-2022-25883)
→ in devDeps, deprioritize
44 filtered: 38 dev-only, 4 transitive-unreachable, 2 disputed/withdrawn
MIT