# Audit Dependencies

> Audit project dependencies for outdated versions, known vulnerabilities, unmaintained packages, and license issues, then produce a prioritized upgrade and replacement plan.

- **Type:** Skill
- **Install:** `agentstack add skill-tomzx-agents-audit-dependencies`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [tomzx](https://agentstack.voostack.com/s/tomzx)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [tomzx](https://github.com/tomzx)
- **Source:** https://github.com/tomzx/agents/tree/main/skills/audit-dependencies

## Install

```sh
agentstack add skill-tomzx-agents-audit-dependencies
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

TODAY=!`date +%Y-%m-%d`

# Dependency Audit

Audits all direct and transitive dependencies for four risk categories: security vulnerabilities, outdated versions, unmaintained packages, and license incompatibilities. Produces a prioritized action plan that maps directly to the SDLC fast path for dependency updates.

## Prerequisites

- Working directory is the root of the repository
- Package manager manifest present (`pyproject.toml`, `package.json`, `go.mod`, `Cargo.toml`, etc.)
- Network access for vulnerability database lookups
- Language-specific tools:
  - Python: `pip-audit` (`uv tool install pip-audit`), `uv` or `pip`
  - JavaScript/TypeScript: `npm audit` or `pnpm audit`
  - Go: `govulncheck` (`go install golang.org/x/vuln/cmd/govulncheck@latest`)
  - Rust: `cargo audit` (`cargo install cargo-audit`)

## Risk Categories

| Category | Priority | Action |
|----------|----------|--------|
| Known CVE (critical/high) | 🔴 Immediate | Upgrade or replace within the sprint |
| Known CVE (medium/low) | 🟡 Soon | Schedule for next sprint |
| Outdated major version | 🟡 Soon | Review changelog, plan upgrade |
| Outdated minor/patch | 🟢 Routine | Batch update |
| Unmaintained (no release > 2 years, archived, or deprecated) | 🟡 Soon | Find replacement |
| License incompatibility | 🔴 Immediate (legal) | Remove or replace |
| Duplicate functionality | 🟢 Routine | Consolidate |
| Unsafe version ranges (no upper bound, or over-pinned) | 🟡 Soon | Tighten ranges, add constraints |

## Steps

### 1. Identify Package Manager(s)

```
ls pyproject.toml requirements*.txt package.json go.mod Cargo.toml 2>/dev/null
```

Handle monorepos by scanning subdirectories:
```
find . -name "pyproject.toml" -o -name "package.json" -o -name "go.mod" -o -name "Cargo.toml" | grep -v node_modules | grep -v ".venv"
```

### 2. Security Vulnerability Scan

**Python:**
```
pip-audit --format=markdown
```

**JavaScript/TypeScript:**
```
npm audit --json 2>/dev/null | jq '.vulnerabilities | to_entries[] | {name: .key, severity: .value.severity, via: .value.via[0].url // "transitive"}'
```
or
```
pnpm audit --json 2>/dev/null
```

**Go:**
```
govulncheck ./...
```

**Rust:**
```
cargo audit
```

### 3. Check for Outdated Packages

**Forward compatibility check — version range strategy:** review how each dependency is constrained. Ranges with no upper bound can pull a breaking major on resolve; over-pinning to an exact patch blocks security upgrades and future evolution. Flag ranges that are unsafe for forward compatibility and recommend upper bounds or caret/tilde constraints that allow additive upgrades.

**Python (uv):**
```
uv pip list --outdated 2>/dev/null || pip list --outdated --format=columns
```

**Python (direct deps only from pyproject.toml):**
```
cat pyproject.toml | grep -A50 '\[project\]' | grep -E '^\s+"[a-zA-Z]' | \
  sed 's/.*"\([a-zA-Z0-9_-]*\).*/\1/' | \
  xargs -I{} sh -c 'latest=$(pip index versions {} 2>/dev/null | head -1 | sed "s/.*(\(.*\))/\1/"); installed=$(pip show {} 2>/dev/null | grep Version | awk "{print \$2}"); echo "${}  installed=$installed  latest=$latest"'
```

**JavaScript/TypeScript:**
```
npx npm-check-updates --format markdown 2>/dev/null || npm outdated
```

**Go:**
```
go list -m -u all 2>/dev/null | grep '\['
```

**Rust:**
```
cargo outdated 2>/dev/null
```

### 4. Identify Unmaintained Packages

For each direct dependency, check last release date and repository status.

**Python — check PyPI metadata:**
```
pip show  | grep Home-page
# Then check: last release on PyPI, GitHub archive status, deprecation notices
```

Signals of abandonment:
- No release in the past 24 months
- Repository archived on GitHub
- PyPI page shows "This project has been archived"
- README says "deprecated" or "use X instead"

**JavaScript — check npm:**
```
npm view  time.modified repository.url
```

### 5. License Compliance Check

**Python:**
```
pip-licenses --format=markdown --order=license 2>/dev/null || \
  pip show $(pip list --format=freeze | cut -d= -f1) 2>/dev/null | grep -E "^(Name|License):"
```

**JavaScript:**
```
npx license-checker --summary --production 2>/dev/null
```

Flag licenses that are typically incompatible with proprietary software:
- GPL, AGPL, LGPL (copyleft — may require source disclosure)
- SSPL (Server Side Public License)
- Unknown / no license declared

### 6. Identify Duplicate Functionality

Look for multiple packages solving the same problem:
- Multiple HTTP clients (`requests` + `httpx` + `urllib3` directly)
- Multiple date libraries (`arrow` + `pendulum` + `dateutil`)
- Multiple test runners or assertion libraries

```
cat pyproject.toml package.json 2>/dev/null | grep -E '"[a-z]' | head -40
```

### 7. Prioritize and Plan

Group findings into four action tracks:

**Track 1 — Fix now (this sprint)**
CVEs rated critical or high; license violations.

**Track 2 — Fix soon (next sprint)**
CVEs rated medium/low; unmaintained packages with viable replacements; major version upgrades with breaking changes that need planning.

**Track 3 — Routine batch update**
Outdated minor/patch versions with no known issues.

**Track 4 — Monitor**
Packages that are slightly outdated but actively maintained and stable.

### 8. Print the Report

```
# Dependency Audit — {TODAY}

## Summary

- Dependencies audited: N direct, N transitive
- 🔴 Critical/High CVEs: N
- 🟡 Medium/Low CVEs: N
- Outdated packages: N (N major, N minor/patch)
- Unmaintained packages: N
- License issues: N

## Track 1 — Fix Now

| Package | Installed | Issue | Action |
|---------|-----------|-------|--------|
| `foo` | 1.2.3 | CVE-2024-XXXX (critical) | Upgrade to ≥ 1.4.0 |

## Track 2 — Fix Soon

| Package | Installed | Latest | Issue | Action |
|---------|-----------|--------|-------|--------|

## Track 3 — Batch Update

## Track 4 — Monitor

## Replacement Recommendations

| Current | Reason | Recommended replacement |
|---------|--------|------------------------|
| `foo` | Unmaintained since 2021 | `bar` — actively maintained, API-compatible |

## License Issues

| Package | License | Risk | Action |
|---------|---------|------|--------|
```

## Example Usage

**Scenario 1: Routine quarterly audit**
```
/dependency-audit
```
Finds 2 medium CVEs in transitive deps, 8 outdated minor versions, and 1 unmaintained package. Produces a three-track plan; Track 1 is empty so no urgent work needed.

**Scenario 2: Pre-release security gate**
```
/dependency-audit
```
Finds a critical CVE in a direct HTTP library. Immediately creates a Track 1 item; feeds into `/create-issue` → `/sdlc dependency` fast path.

## Useful Commands Reference

| Command | Description |
|---------|-------------|
| `pip-audit --format=markdown` | Python vulnerability scan |
| `npm audit --json` | Node.js vulnerability scan |
| `govulncheck ./...` | Go vulnerability scan |
| `cargo audit` | Rust vulnerability scan |
| `pip-licenses --format=markdown` | Python license summary |
| `npx license-checker --summary --production` | JS/TS license summary |
| `npx npm-check-updates` | JS/TS outdated package check |
| `go list -m -u all` | Go module update availability |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [tomzx](https://github.com/tomzx)
- **Source:** [tomzx/agents](https://github.com/tomzx/agents)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-tomzx-agents-audit-dependencies
- Seller: https://agentstack.voostack.com/s/tomzx
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.