pm-claude-skills/exports/aider/pm-engineering/dependency-audit/dependency-audit.md

Dependency Audit Skill

Produce a complete dependency audit report for a project — covering security vulnerabilities (with CVE references), license compliance against policy, outdated packages prioritised by risk, transitive dependency risk analysis, and a concrete remediation plan with timeline. A good dependency audit gives the team a clear, prioritised action list — not a raw dump of audit output that no one acts on.

Required Inputs

Ask for these if not already provided:

• Project language and ecosystem — npm, pip/PyPI, Maven/Gradle, Go modules, Cargo, RubyGems, NuGet, or mixed
• Dependency list or package manifest — paste the contents of package.json, requirements.txt, go.mod, pom.xml, etc., or provide the audit tool output
• License policy — which licenses are allowed, which are restricted (e.g. "GPL is prohibited", "MIT/Apache/BSD only", or "no policy yet — recommend one")
• Current security tooling — Dependabot, Snyk, OWASP Dependency-Check, npm audit, pip-audit, or none

Output Format

---

Dependency Audit Report: [Project Name]

Ecosystem: [npm / pip / Maven / Go / etc.] Audit date: [Date] Auditor: [Name] Total direct dependencies: [N] Total transitive dependencies: [N] Audit tool(s) used: [npm audit / pip-audit / Snyk / OWASP Dependency-Check / etc.]

---

Executive Summary

Category	Finding	Risk level
Critical vulnerabilities	[N] CVEs requiring immediate action	[Critical / High / Low]
High vulnerabilities	[N] CVEs — fix within 7 days	[High / Medium]
License violations	[N] packages with non-compliant licenses	[High / Low]
Severely outdated packages	[N] packages > 2 major versions behind	[Medium]
Packages with no active maintenance	[N] packages — no commits in 12+ months	[Medium]
Overall dependency health score	[Score]/100	[Red / Amber / Green]

Scoring methodology: Critical CVEs: −20 each. High CVEs: −10 each. License violations: −15 each. Abandoned packages: −5 each. Maximum deduction: 100. Score ≥80 = Green, 60–79 = Amber, <60 = Red.

Immediate actions required:

1. [Most critical action — e.g. "Upgrade lodash from 4.17.11 to 4.17.21 to fix CVE-2021-23337 (Critical — prototype pollution)"]
2. [Second action]
3. [Third action]

---

1. Security Vulnerability Findings

Critical and High Severity (Act within 24–72 hours)

Package	Installed version	Fix version	CVE	Severity	CVSS score	Description	Exploitability
[package-name]	[X.Y.Z]	[A.B.C]	[CVE-YYYY-NNNNN]	Critical	[9.x]	[e.g. Prototype pollution via merge function — remote code execution possible]	[Known exploit / PoC available / No known exploit]
[package-name]	[X.Y.Z]	[A.B.C]	[CVE-YYYY-NNNNN]	High	[7.x]	[e.g. Path traversal in file serving utility]	[PoC available]
[package-name]	[X.Y.Z]	[A.B.C]	[CVE-YYYY-NNNNN]	High	[7.x]	[e.g. Regular expression denial of service (ReDoS)]	[No known exploit]

Medium Severity (Fix within 30 days)

Package	Installed version	Fix version	CVE	Severity	CVSS score	Description
[package-name]	[X.Y.Z]	[A.B.C]	[CVE-YYYY-NNNNN]	Medium	[5.x]	[Description]
[package-name]	[X.Y.Z]	[A.B.C]	[CVE-YYYY-NNNNN]	Medium	[4.x]	[Description]

Low Severity (Fix within 90 days or accept risk)

Package	Installed version	Fix version	CVE	Severity	Description
[package-name]	[X.Y.Z]	[A.B.C]	Low	[Description]

Vulnerabilities With No Fix Available

Package	CVE	Severity	Recommended mitigation
[package-name]	[CVE-YYYY-NNNNN]	[High]	[e.g. "Remove this package — alternative: [replacement]"]
[package-name]	[CVE-YYYY-NNNNN]	[Medium]	[e.g. "Vendor has a fix in progress — track issue [URL]. Mitigate by [X]"]

---

2. License Compliance Matrix

License Policy Reference

License	Category	Policy	Notes
MIT	Permissive	Allowed	Attribution required in distributed products
Apache 2.0	Permissive	Allowed	Attribution + NOTICE file required
BSD 2-Clause / 3-Clause	Permissive	Allowed	Attribution required
ISC	Permissive	Allowed
MPL 2.0	Weak copyleft	Allowed with review	Source disclosure required for modified MPL files only
LGPL v2 / v3	Weak copyleft	Allowed with review	Dynamic linking permitted; static linking may require disclosure
GPL v2 / v3	Strong copyleft	Restricted	May require open-sourcing the entire codebase — legal review required
AGPL v3	Strong copyleft	Restricted	Network use triggers copyleft — especially risky for SaaS
SSPL	Source available	Prohibited	Not OSI-approved — treat as proprietary
Proprietary / Commercial	Commercial	Requires contract	Verify license covers current use case and scale
Unknown / Unlicensed	—	Prohibited	No license = all rights reserved — cannot use legally

Findings: Packages With Compliance Issues

Package	License	Issue	Recommendation	Risk if unaddressed
[package-name]	GPL v3	Copyleft — may require open-sourcing this project	Replace with [alternative] or get legal sign-off	Legal / IP risk
[package-name]	AGPL v3	Network copyleft — SaaS use triggers disclosure	Replace with [alternative]	Legal / IP risk
[package-name]	Proprietary	License may not cover current usage tier	Verify license scope with vendor	Contract breach
[package-name]	Unknown	No license declared in package metadata	Contact maintainer or replace	Cannot use legally

All Licenses in Use (Full Inventory)

License	Package count	Compliance status
MIT	[N]	Compliant
Apache 2.0	[N]	Compliant
BSD-3-Clause	[N]	Compliant
ISC	[N]	Compliant
MPL 2.0	[N]	Review required
GPL v3	[N]	Non-compliant
Unknown	[N]	Non-compliant

---

3. Outdated Package Analysis

Severely Outdated (2+ major versions behind — high upgrade effort)

Package	Installed	Latest stable	Versions behind	Last updated	Breaking changes summary
[package-name]	[1.x.x]	[3.x.x]	2 major	[Date]	[e.g. "API redesign in v2; async support added in v3"]
[package-name]	[0.x.x]	[2.x.x]	2 major	[Date]	[Summary]

Moderately Outdated (1 major version behind)

Package	Installed	Latest stable	Versions behind	Security fix in newer version?
[package-name]	[2.x.x]	[3.x.x]	1 major	[Yes — CVE-YYYY-NNNNN / No]
[package-name]	[4.x.x]	[5.x.x]	1 major	[No]

Minor/Patch Updates Available (Low risk to update)

Package	Installed	Latest	Contains security fix?
[package-name]	[2.3.1]	[2.3.9]	[Yes / No]
[package-name]	[1.0.0]	[1.2.1]	[No]

---

4. Dependency Graph Risk Analysis

Transitive Dependency Risk

Transitive (indirect) dependencies carry risk because they are not explicitly managed. These are the highest-risk transitive dependencies in this project:

Vulnerable transitive dep	Pulled in by	Installed version	Fix available	Action
[transitive-package]	[direct-parent]	[X.Y.Z]	[Yes — upgrade [parent] to [version]]	Upgrade direct dependency [parent]
[transitive-package]	[direct-parent]	[X.Y.Z]	[No]	Remove [parent] or use [alternative]

Dependency Concentration Risk

These packages are depended on by many other packages in the project — a vulnerability or deprecation would have cascading effects:

Package	Depended on by (N packages)	Actively maintained?	Risk level
[package-name]	[N]	[Yes / No — last commit: date]	[High / Medium]
[package-name]	[N]	[Yes]	[Medium]

Abandoned / Unmaintained Packages

Package	Last release	Last commit	Weekly downloads	Recommended alternative
[package-name]	[Date]	[Date]	[N]	[alternative-package]
[package-name]	[Date]	[Date]	[N]	[Maintained fork: URL]

---

5. Remediation Plan

30-Day Plan

Week 1 — Critical vulnerabilities (Days 1–7)

Action	Owner	Package	Effort	Notes
Upgrade [package] [old] → [new]	[Name]	[package-name]	[30 min]	[No API changes / check breaking changes guide: URL]
Replace [package] with [alternative]	[Name]	[package-name]	[2 hours]	[No fix available — must replace]
Patch override for [transitive-dep]	[Name]	[transitive-dep]	[15 min]	[Add resolutions/overrides entry in manifest]

# Commands for Week 1 upgrades:

# npm
npm install [package]@[target-version]
npm audit fix --force  # use with caution — may introduce breaking changes

# pip
pip install --upgrade [package]==[target-version]
pip-audit --fix  # if using pip-audit

# Go
go get [module]@[version]
go mod tidy

# Maven
# Update pom.xml version property, then:
mvn versions:use-latest-releases -DallowMajorUpdates=false
mvn dependency:resolve

Week 2 — High vulnerabilities and license violations (Days 8–14)

Action	Owner	Package	Effort	Notes
Upgrade [package]	[Name]	[package-name]	[1 hour]
Replace GPL-licensed [package]	[Name]	[package-name]	[4 hours]	[Alternative: [package]]
Legal review for [package] license	Legal team	[package-name]	[Legal team SLA]	[Submit via [process]]

Week 3 — Medium vulnerabilities and abandoned packages (Days 15–21)

Action	Owner	Package	Effort	Notes
Upgrade [package]	[Name]	[package-name]	[30 min]
Replace abandoned [package]	[Name]	[package-name]	[2 hours]	[Maintained fork or alternative: [URL]]

Week 4 — Process improvements (Days 22–30)

Action	Owner	Effort	Notes
Enable Dependabot / Renovate for automated PRs	[Name]	[2 hours]	[Config in Section 6]
Add npm audit / pip-audit to CI — fail on Critical/High	[Name]	[1 hour]	[Config in Section 6]
Document license policy in CONTRIBUTING.md	[Name]	[1 hour]	[Based on policy in Section 2]
Schedule next quarterly audit	[Name]	[15 min]	[Add to team calendar]

---

6. Policy Recommendations

Automated Vulnerability Scanning in CI

Add the following to your CI pipeline to catch vulnerabilities before they merge:

# GitHub Actions — adapt for your CI platform
dependency-audit:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v3

    # npm
    - name: npm audit
      run: npm audit --audit-level=high
      # Fails build on High or Critical vulnerabilities

    # pip
    - name: pip-audit
      run: |
        pip install pip-audit
        pip-audit --requirement requirements.txt --severity high

    # Go
    - name: govulncheck
      run: |
        go install golang.org/x/vuln/cmd/govulncheck@latest
        govulncheck ./...

Dependabot / Renovate Configuration

# .github/dependabot.yml — automated dependency update PRs
version: 2
updates:
  - package-ecosystem: "[npm / pip / gomod / maven]"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "automated"
    ignore:
      # Ignore major version bumps — review these manually
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

License Scanning

# npm — license checker
npx license-checker --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC' \
  --failOn 'GPL;AGPL;LGPL'

# Python — pip-licenses
pip install pip-licenses
pip-licenses --allow-only="MIT;Apache Software License;BSD License;ISC License" \
  --fail-on="GNU General Public License"

# Go — go-licenses
go install github.com/google/go-licenses@latest
go-licenses check ./... --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause

---

7. Dependency Health Score Detail

Category	Max points	Score	Notes
No critical vulnerabilities	30	[N]/30	−20 per critical CVE
No high vulnerabilities	20	[N]/20	−10 per high CVE
License compliance	20	[N]/20	−15 per violation
No abandoned packages	15	[N]/15	−5 per abandoned package
Up-to-date major versions	10	[N]/10	−2 per major version behind
Automated scanning enabled	5	[N]/5	All-or-nothing
Total	100	[Score]/100	[Red / Amber / Green]

---

Quality Checks

• Every Critical and High CVE has a named owner and a resolution date in the 30-day plan
• License findings have been reviewed by legal or a named engineer with authority to accept the risk
• Transitive dependency vulnerabilities are included — not just direct dependencies
• Abandoned packages have a concrete replacement recommendation, not just "consider replacing"
• CI pipeline change is included — the audit findings should be the last time these are caught manually
• The dependency health score is calculated from actual findings, not estimated
• Remediation plan actions are specific commands or steps, not "upgrade package X" without version targets

Anti-Patterns

• Do not report only direct dependencies — transitive dependency vulnerabilities are often more dangerous and are the most commonly missed
• Do not present raw audit tool output without interpretation — a table of 200 CVEs with no prioritisation is worse than no audit at all
• Do not assign all Critical CVEs as "fix immediately" without checking whether an exploitable path exists in your usage context
• Do not make license compliance decisions without legal input — flagging a GPL dependency without a recommendation is incomplete work
• Do not complete the audit without including a CI/CD pipeline step — a one-time audit that leaves the door open for new vulnerabilities is not a remediation