/dependency-audit

name: memstack-security-dependency-audit
description: "Use this skill when the user says 'dependency audit', 'npm audit', 'pip audit', 'cargo audit', 'security vulnerabilities', 'outdated packages', 'supply chain', or needs to scan project dependencies for vulnerabilities, abandoned packages, and upgrade risks. Do NOT use for application-level security or secrets scanning."
version: 1.0.0
license: "Proprietary, MemStack™ Pro by CW Affiliate Investments LLC. See LICENSE.txt"

🔒 Dependency Audit: Supply Chain Security Scanner

*Scan project dependencies for vulnerabilities, outdated packages, abandoned libraries, and supply chain risks with a prioritized upgrade plan.*

Activation

When this skill activates, output:

`🔒 Dependency Audit: Scanning your dependency tree...`

| Context | Status | |---------|--------| | **User says "dependency audit", "npm audit", "scan dependencies"** | ACTIVE | | **User wants to check for vulnerable or outdated packages** | ACTIVE | | **User mentions CVEs, supply chain security, or abandoned packages** | ACTIVE | | **User wants OWASP web app security (not just dependencies)** | DORMANT: see owasp-top10 | | **User wants secrets scanning (not package vulnerabilities)** | DORMANT: see secrets-scanner | | **User wants general code review** | DORMANT: see code-reviewer |

Protocol

Step 1: Detect Project Type

Identify the package ecosystem from project files:

| File Found | Ecosystem | Audit Command | Outdated Command | |-----------|-----------|---------------|-----------------| | `package.json` | npm/Node.js | `npm audit --json` | `npm outdated --json` | | `package-lock.json` | npm (locked) | `npm audit --json` | `npm outdated --json` | | `yarn.lock` | Yarn | `yarn audit --json` | `yarn outdated --json` | | `pnpm-lock.yaml` | pnpm | `pnpm audit --json` | `pnpm outdated --json` | | `requirements.txt` | pip/Python | `pip audit --format=json` | `pip list --outdated --format=json` | | `Pipfile.lock` | Pipenv | `pipenv check --output json` | `pipenv update --dry-run` | | `pyproject.toml` | Poetry/Python | `pip audit --format=json` | `poetry show --outdated` | | `Cargo.toml` | Rust/Cargo | `cargo audit --json` | `cargo outdated --format json` | | `go.mod` | Go | `govulncheck ./...` | `go list -u -m all` | | `Gemfile.lock` | Ruby/Bundler | `bundle audit check --format json` | `bundle outdated` |

If multiple ecosystems detected, audit all of them. Report which ecosystem each finding belongs to.

Step 2: Run Vulnerability Scan

Execute the appropriate audit command and parse results into a unified format:

── VULNERABILITY SCAN ─────────────────────

CVE-2024-XXXXX  🔴 CRITICAL
  Package: [name]@[version]
  Dependency: Direct / Transitive (via [parent])
  Fixed in: [version]
  Description: [brief description]
  CVSS Score: [score]
  Exploitability: [network/local] [complexity]

CVE-2024-YYYYY  🟡 HIGH
  Package: [name]@[version]
  Dependency: Transitive (via [parent] → [grandparent])
  Fixed in: [version]
  Description: [brief description]
  CVSS Score: [score]
  Exploitability: [network/local] [complexity]

**Severity classification:**

| Severity | CVSS Score | Icon | Action | |----------|-----------|------|--------| | Critical | 9.0 - 10.0 | 🔴 | Fix immediately: potential active exploitation | | High | 7.0 - 8.9 | 🟡 | Fix within 1 week: significant risk | | Medium | 4.0 - 6.9 | 🟠 | Fix within 1 month: moderate risk | | Low | 0.1 - 3.9 | 🔵 | Fix when convenient: minimal risk |

**Direct vs transitive priority:**

• **Direct dependency**: You explicitly installed it, highest priority, easiest to fix
• **Transitive dependency**: Pulled in by another package, fix by updating the direct parent
• If the transitive parent hasn't released a fix, consider overriding with `overrides` (npm) or `resolutions` (Yarn)

Step 3: Check for Outdated Packages

Run the outdated command and categorize results:

── OUTDATED PACKAGES ──────────────────────

Package          Current    Latest     Type      Risk
─────────────────────────────────────────────────────
[package-a]      1.2.3      1.2.8      Patch     ✅ Safe, bug fixes only
[package-b]      2.1.0      2.4.0      Minor     ✅ Safe, new features, backward compatible
[package-c]      3.0.0      4.2.1      Major     ⚠️ Breaking, review changelog
[package-d]      1.0.0      1.0.0      Current   ✅ Up to date

**Version gap classification:**

| Gap Type | Risk | Approach | |----------|------|----------| | **Patch** (1.2.3 → 1.2.8) | Very Low | Update immediately: bug/security fixes | | **Minor** (2.1.0 → 2.4.0) | Low | Update in batch: new features, backward compatible | | **Major** (3.0.0 → 4.2.1) | Medium-High | Review migration guide, test thoroughly | | **Multiple majors** (1.x → 4.x) | High | Dedicate time, may require code changes |

Step 4: Identify Abandoned Packages

Check each dependency for maintenance status:

── ABANDONED PACKAGE CHECK ────────────────

Package          Last Publish    Downloads/wk    Status
──────────────────────────────────────────────────────
[package-x]      3 years ago     12,000          ⚠️ ABANDONED, find alternative
[package-y]      2.5 years ago   800             🔴 DEAD, replace immediately
[package-z]      6 months ago    250,000         ✅ Active

**Abandonment indicators:**

• No npm/PyPI publish in 2+ years
• No GitHub commits in 1+ year
• Open issues/PRs with no maintainer response for 6+ months
• Maintainer has publicly archived the repository
• Deprecation notice in README or package metadata

**For each abandoned package, suggest:**

• Alternative package (actively maintained fork or replacement)
• Migration effort estimate (drop-in replacement vs API changes)
• Risk of staying: known unpatched vulnerabilities, compatibility drift

Step 5: Supply Chain Risk Assessment

Check for packages with known supply chain risk factors:

| Risk Factor | Detection Method | Severity | |-------------|-----------------|----------| | **Typosquatti