dependency-audit

Name: dependency-audit
Author: briiirussell

320stars36forks

How to install dependency-audit?

briiirussell/cybersecurity-skills/dependency-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill dependency-audit

Installs into the current project.

Summary

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnera

Files · 1

View on GitHub

SKILL.md

1	# Dependency Audit — Framework, Package, and Toolchain Security
2
3	Audit project dependencies, frameworks, language runtimes, and dev tools for known vulnerabilities (CVEs), security anti-patterns, and supply chain risks.
4
5	## Methodology
6
7	### Step 1: Inventory the Stack
8
9	Identify everything in use — not just direct dependencies but the full chain:
10
11	Package manifests — read and catalog:
12	```
13	Node/JS: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
14	Python: requirements.txt, Pipfile.lock, pyproject.toml, poetry.lock
15	Ruby: Gemfile, Gemfile.lock
16	Go: go.mod, go.sum
17	Rust: Cargo.toml, Cargo.lock
18	Java: pom.xml, build.gradle
19	PHP: composer.json, composer.lock
20	.NET: *.csproj, packages.config
21	```
22
23	Framework and runtime versions:
24	- Check framework version (Next.js, Django, Rails, Spring, Laravel, Express, etc.)
25	- Check language/runtime version (Node.js, Python, Ruby, Go, Java, PHP, .NET)
26	- Check infrastructure tools (Docker base images, Terraform providers, Kubernetes versions)
27
28	Dev tools and CI/CD:
29	- Check CI/CD pipeline configs (.github/workflows, .gitlab-ci.yml, Jenkinsfile)
30	- Check pre-commit hooks, linters, formatters
31	- Check container base images and their update status
32	- Check IaC tool versions (Terraform, Pulumi, CDK)
33
34	Edge cases in package manifests:
35	- `optionalDependencies` — installed but not audited by default
36	- `peerDependencies` — version range may not match what's installed
37	- `overrides` / yarn `resolutions` / pnpm `overrides` — check if used to silence advisories rather than fix them
38	- Monorepos: read every `packages//package.json` and `apps//package.json`, not just the root
39	- `engines` field — older-than-LTS Node makes other audits moot
40
41	### Step 2: Run Automated Audit Tools
42
43	Run the appropriate audit command for the project:
44
45	```bash
46	# Node.js
47	npm audit --json # full structured output
48	npm audit --omit=dev --json # production-only: filters dev/build-time vulns
49	# Compare the two — vulns only in dev/build tooling do not ship to users
50	# and should be triaged as lower priority. Don't bury this in the report.
51
52	# Python
53	pip audit # If pip-audit installed
54	safety check # If safety installed
55
56	# Ruby
57	bundle audit
58
59	# Go
60	govulncheck ./...
61
62	# Rust
63	cargo audit
64
65	# PHP
66	composer audit
67
68	# .NET
69	dotnet list package --vulnerable
70
71	# Docker
72	docker scout cves <image>
73	trivy image <image>
74
75	# General (if Trivy is available)
76	trivy fs .
77	```
78
79	Applying fixes — read before you `--force`:
80
81	```bash
82	npm audit fix # safe: upgrades within stated ranges
83	npm audit fix --dry-run --force # ALWAYS dry-run first
84	npm audit fix --force # only after reviewing the dry-run
85	```
86
87	`npm audit fix --force` can resolve an advisory by DOWNGRADING a package to an older version that doesn't trigger the audit signature. This is almost always wrong (e.g. downgrading `next@16` to `next@9` to "fix" a transitive postcss CVE). Inspect dry-run output for "Will install X@Y, which is a breaking change" — that's the tool trying to downgrade.
88
89	When `npm audit fix` cannot resolve an advisory (transitive dep pinned by an upstream package):
90
91	1. Determine reachability — is the vulnerable code path actually invoked in your usage? `npm ls <package>` + reading the parent's source can rule it out as unreachable.
92	2. Consider a `package.json` `overrides` pin to a patched version (test thoroughly — overrides can break the parent).
93	3. Consider swapping the parent provider entirely.
94	4. If none apply: document explicitly, track upstream, and note in the audit report rather than silently dropping the finding.
95
96	### Step 3: Research Framework-Specific Known Issues
97
98	Beyond CVEs in packages, check for known vulnerability patterns specific to the framework in use. Search for recent advisories and common misconfiguration issues.
99
100	For every direct dependency, cross-reference the installed version against:
101	- `https://github.com/advisories?ecosystem=npm&query=<package>`
102	- `https://github.com/<org>/<repo>/security/advisories`
103
104	The framework-specific patterns below cover evergreen anti-patterns (mass assignment, debug-in-prod, etc.). Recent CVEs need a fresh check because hardcoded advisory lists rot fast and LLM training data is often 6+ months behind the latest.
105
106	Next.js / React:
107	- Server Actions exposing internal endpoints (pre-14.1.1 middleware bypass CVE-2025-29927)
108	- `dangerouslySetInner

People who liked this also viewed

6 picks

Type

dependency-audit

320stars36forks

View on GitHub

How to install dependency-audit?

briiirussell/cybersecurity-skills/dependency-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill dependency-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Dependency Audit — Framework, Package, and Toolchain Security
2
3	Audit project dependencies, frameworks, language runtimes, and dev tools for known vulnerabilities (CVEs), security anti-patterns, and supply chain risks.
4
5	## Methodology
6
7	### Step 1: Inventory the Stack
8
9	Identify everything in use — not just direct dependencies but the full chain:
10
11	Package manifests — read and catalog:
12	```
13	Node/JS: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
14	Python: requirements.txt, Pipfile.lock, pyproject.toml, poetry.lock
15	Ruby: Gemfile, Gemfile.lock
16	Go: go.mod, go.sum
17	Rust: Cargo.toml, Cargo.lock
18	Java: pom.xml, build.gradle
19	PHP: composer.json, composer.lock
20	.NET: *.csproj, packages.config
21	```
22
23	Framework and runtime versions:
24	- Check framework version (Next.js, Django, Rails, Spring, Laravel, Express, etc.)
25	- Check language/runtime version (Node.js, Python, Ruby, Go, Java, PHP, .NET)
26	- Check infrastructure tools (Docker base images, Terraform providers, Kubernetes versions)
27
28	Dev tools and CI/CD:
29	- Check CI/CD pipeline configs (.github/workflows, .gitlab-ci.yml, Jenkinsfile)
30	- Check pre-commit hooks, linters, formatters
31	- Check container base images and their update status
32	- Check IaC tool versions (Terraform, Pulumi, CDK)
33
34	Edge cases in package manifests:
35	- `optionalDependencies` — installed but not audited by default
36	- `peerDependencies` — version range may not match what's installed
37	- `overrides` / yarn `resolutions` / pnpm `overrides` — check if used to silence advisories rather than fix them
38	- Monorepos: read every `packages//package.json` and `apps//package.json`, not just the root
39	- `engines` field — older-than-LTS Node makes other audits moot
40
41	### Step 2: Run Automated Audit Tools
42
43	Run the appropriate audit command for the project:
44
45	```bash
46	# Node.js
47	npm audit --json # full structured output
48	npm audit --omit=dev --json # production-only: filters dev/build-time vulns
49	# Compare the two — vulns only in dev/build tooling do not ship to users
50	# and should be triaged as lower priority. Don't bury this in the report.
51
52	# Python
53	pip audit # If pip-audit installed
54	safety check # If safety installed
55
56	# Ruby
57	bundle audit
58
59	# Go
60	govulncheck ./...
61
62	# Rust
63	cargo audit
64
65	# PHP
66	composer audit
67
68	# .NET
69	dotnet list package --vulnerable
70
71	# Docker
72	docker scout cves <image>
73	trivy image <image>
74
75	# General (if Trivy is available)
76	trivy fs .
77	```
78
79	Applying fixes — read before you `--force`:
80
81	```bash
82	npm audit fix # safe: upgrades within stated ranges
83	npm audit fix --dry-run --force # ALWAYS dry-run first
84	npm audit fix --force # only after reviewing the dry-run
85	```
86
87	`npm audit fix --force` can resolve an advisory by DOWNGRADING a package to an older version that doesn't trigger the audit signature. This is almost always wrong (e.g. downgrading `next@16` to `next@9` to "fix" a transitive postcss CVE). Inspect dry-run output for "Will install X@Y, which is a breaking change" — that's the tool trying to downgrade.
88
89	When `npm audit fix` cannot resolve an advisory (transitive dep pinned by an upstream package):
90
91	1. Determine reachability — is the vulnerable code path actually invoked in your usage? `npm ls <package>` + reading the parent's source can rule it out as unreachable.
92	2. Consider a `package.json` `overrides` pin to a patched version (test thoroughly — overrides can break the parent).
93	3. Consider swapping the parent provider entirely.
94	4. If none apply: document explicitly, track upstream, and note in the audit report rather than silently dropping the finding.
95
96	### Step 3: Research Framework-Specific Known Issues
97
98	Beyond CVEs in packages, check for known vulnerability patterns specific to the framework in use. Search for recent advisories and common misconfiguration issues.
99
100	For every direct dependency, cross-reference the installed version against:
101	- `https://github.com/advisories?ecosystem=npm&query=<package>`
102	- `https://github.com/<org>/<repo>/security/advisories`
103
104	The framework-specific patterns below cover evergreen anti-patterns (mass assignment, debug-in-prod, etc.). Recent CVEs need a fresh check because hardcoded advisory lists rot fast and LLM training data is often 6+ months behind the latest.
105
106	Next.js / React:
107	- Server Actions exposing internal endpoints (pre-14.1.1 middleware bypass CVE-2025-29927)
108	- `dangerouslySetInner

People who liked this also viewed

6 picks

Type