dependency-auditlisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/dependency-audit/SKILL.md. --> # Dependency Audit Audit project dependencies for known vulnerabilities, malicious packages, and supply chain risks ## ALWAYS - Pin dependencies to exact versions in lockfiles (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `poetry.lock`, `go.sum`, `Cargo.lock`). - Cross-check every new dependency name against the bundled malicious-package list in `vulnerabilities/supply-chain/malicious-packages/`. - Prefer well-established packages with high download counts, multiple maintainers, and recent activity over newer alternatives that solve the same problem. - Run the package manager's audit command (`npm audit`, `pip-audit`, `cargo audit`, `govulncheck`) and review reported issues before merging. - Verify the package's repository URL on the package page actually exists and matches the linked GitHub / GitLab / Codeberg project. - Track **embedded runtimes** you ship — a bundled browser engine (Electron / CEF / Chromium / system WebView), a language runtime, or a JRE — against their **upstream** EOL and security releases. Their CVEs are filed against the upstream project, not the wrapper package (`electron`, `pywebview`, …), so `npm audit` / Trivy / Dependabot match the wrapper version and report the engine as clean. Pin a supported major; auto-update it. ## NEVER - Add a dependency without pinning it