dependency-risk-auditorlisted
Install: claude install-skill OneDro1d/dark-factory
# Dependency Risk Auditor
Analyze third-party dependencies for security vulnerabilities, maintenance health, license compliance, and vendor lock-in risk.
## Core Risks
| Risk Category | Impact | Example |
|---------------|--------|---------|
| **Security** | Data breach, RCE | Known CVE in dependency |
| **Maintenance** | Future breakage | Unmaintained package |
| **License** | Legal liability | GPL in proprietary code |
| **Lock-in** | Migration cost | Deep integration with single vendor |
| **Supply Chain** | Compromise | Malicious package update |
## When to Use
- Adding new dependencies
- Regular security audits
- Preparing for production deployment
- Evaluating vendor/library choices
- License compliance review
- Investigating transitive dependencies
## Audit Workflow
### Step 1: Inventory Dependencies
```bash
# Node.js - List all dependencies
npm ls --all --depth=10 > deps.txt
npm ls --prod --depth=0 # Production only
# Python
pip list --format=freeze
pip-audit
# Go
go list -m all
# Rust
cargo tree
# Count dependencies
npm ls --all | wc -l
```
Categorize:
| Category | Count | Examples |
|----------|-------|----------|
| Direct (prod) | [N] | express, lodash |
| Direct (dev) | [N] | jest, typescript |
| Transitive | [N] | All nested deps |
| **Total** | [N] | |
### Step 2: Security Scan
```bash
# Node.js
npm audit
npm audit --json > audit.json
# Python
pip-audit
safety check
# Go
go list -json -m all | nancy sleuth
# Rust
cargo audit
# General
snyk te