Dependency Audit: CVEs, Licenses, Safe Upgrades
Triage dependency CVEs by reachability, flag license risks, and sequence safe upgrades across npm, Python, Go, Java, and more.
Before & after
Same prompt, same agent — the only difference is the skill.
A pre-release dependency audit is good practice. Here's what to check: - **Vulnerabilities** — run npm audit, pip-audit, or equivalent for your ecosystem - **Outdated packages** — identify what's behind and what's safe to update - **License compliance** — check for licenses incompatible with your use - **Transitive dependencies** — issues can hide in dependencies of dependencies - **Unused dependencies** — remove what you don't need Prioritize by severity — critical and high vulnerabilities first, then plan updates. Which package managers does your project use?
PRE-RELEASE DEPENDENCY AUDIT — multi-language, prioritized for a
next-week ship. Shape below; run against your lockfiles for actuals.
BLOCKING THIS RELEASE
▸ CVE in a transitive dep (not something you installed directly)
lodash <4.17.21 pulled in via a build tool. Prototype pollution,
high severity. The trap: it's not in your package.json, so a
surface "npm audit" glance can miss why it's there. Fix: force the
resolution or bump the parent.
▸ GPL-licensed package in a proprietary build
One transitive dependency is GPL. If you ship binaries, that's
contamination — legal-blocking, not just a warning. Replace or
isolate before release.
FIX THIS RELEASE IF YOU CAN
▸ 3 direct deps behind by a minor with published CVEs, all
patch-safe (no breaking changes). Low-risk bumps.
DO NOT TOUCH BEFORE THE RELEASE
▸ React 18 → 19 major. It's tempting, it's out of scope, and a major
bump the week of a release is how a security audit becomes an
outage. File it as a post-release upgrade with its own plan.
SAFE-UPGRADE PATHS (the part a plain audit doesn't give you)
For each flagged package: current → safe target, and whether the jump
is patch (safe now), minor (safe, test), or major (defer). This is
what turns "you have 14 vulnerabilities" into "fix these 4 now, defer
1, ignore 9 dev-only."
DEV-ONLY, DEFERRABLE
9 of the findings are in devDependencies and never ship. Real, but
they don't gate a release — separated so they don't inflate the
urgent count.
RELEASE CALL
Block on the two above (CVE + GPL). The three minor bumps are your call
— safe, but a diff is a diff the week of a ship. Point me at the
lockfiles and I'll produce the real prioritized list.About this skill
Your scanner says 147 vulnerabilities, half of them critical, and nobody knows which ones matter. Someone asked whether there is GPL in the product, and a major framework upgrade keeps getting postponed because nobody knows what will break. This skill turns raw audit output and lockfiles into a short, ranked action list. Every finding gets an exact fix path, every license flag gets the real obligation, and upgrades get a PR-by-PR sequence.
What it does
- Ranks vulnerabilities by actual exposure: whether the dependency ships to production, whether the vulnerable function is reachable, whether it is known to be exploited, and whether a fix exists. Raw CVSS score alone does not decide the order.
- Traces every transitive finding back to the direct dependency that pulls it in. Gives the right fix mechanism for your ecosystem: parent bump, npm overrides, pnpm/yarn resolutions, pip constraints, Go module bumps, Maven dependencyManagement, or Gradle constraints.
- Reads licenses as SPDX expressions and explains what each one obligates in your distribution model (SaaS, shipped binary, mobile app, library). Catches AGPL, SSPL/BSL, missing licenses, and metadata that contradicts the LICENSE file.
- Flags supply-chain hygiene gaps: uncommitted or ignored lockfiles, install scripts, abandoned or single-maintainer packages, possible typosquats, and unpinned CI actions.
- Plans major upgrades as a sequence of small PRs. It reads release notes for every intermediate major, checks peer dependencies, and maps breaking changes to the code paths you actually use.
- Gives the exact scanner commands to run when it cannot run them itself. It never pretends a scan happened.
What you get
A ranked findings table with fix commands and verification steps, plus license verdicts and an upgrade sequence where relevant. Quick questions get a short answer, not a full report.
Best for
Engineers and tech leads preparing a release, answering a security questionnaire or due-diligence license request, responding to a newly published CVE, or planning a framework major-version upgrade in npm, Python, Go, JVM, Ruby, Rust, or .NET projects.
SKILL.md preview
---
name: dependency-audit-cves-licenses-upgrades
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.