dependency-awareness

Solid

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable, mix_audit). Load when adding, updating, or auditing project dependencies, wiring up CI supply-chain checks, or triaging CVEs in a lock file.

Data & Documents 137 stars 13 forks Updated today MIT

Install

View on GitHub

Quality Score: 84/100

Stars 20%

Recency 20%

100

Frontmatter 20%

Documentation 15%

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

Audit dependencies before adding them. Prefer well-maintained, widely-used packages with active maintenance. Pin versions and commit lock files. Use language-specific audit tools in CI: - Rust: `cargo audit`, `cargo deny` (license + advisory policies) - Python: `pip-audit`, `bandit` (SAST) - JavaScript/TypeScript: `npm audit`, `pnpm audit` - Go: `govulncheck` - Ruby: `bundler-audit` - PHP: `composer audit` - Java: OWASP `dependency-check` Maven/Gradle plugin - C#: `dotnet list package --vulnerable` - Elixir: `mix_audit` Zero tolerance for critical/high CVEs. Automate dependency update PRs where possible.

Details

Author: Goldziher
Repository: Goldziher/ai-rulez
Created: 1 years ago
Last Updated: today
Language: Go
License: MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

dependency-audit

Audit dependencies for known vulnerabilities, malicious packages, and supply-chain risk. Use when adding or upgrading a dependency, reviewing package.json, requirements.txt, go.mod, or Cargo.toml, or before merging a PR that touches dependency files.

22 Updated 1 weeks ago

ShieldNet-360

AI & Automation Listed

dependency-audit

Audit a project's dependencies for outdated and vulnerable packages and surface breaking-change notes for upgrades. Works with any ecosystem, including npm/pnpm/yarn, pip/Poetry/uv, Cargo, Go modules, Maven/Gradle, Bundler, Composer, and others. Use when checking a project's dependency health, planning upgrades, or responding to a vulnerability report.

4 Updated yesterday

KhaledSaeed18

Code & Development Listed

dependency-audit

Use when adding dependencies, reviewing a project's dependency tree, or checking for known vulnerabilities and ownership risk — covers pip-audit, npm audit, govulncheck, lock file hygiene, update policy, and trust assessment.

1 Updated today

andr-ca