Dependency Audit Knowledge Base

Method for auditing third-party dependencies without inventing facts. The /dependency-audit:deps-audit command orchestrates; this skill holds the depth, split into references loaded on demand.

Core principles

1. Tool-first. The audit runs the ecosystem's own tooling and reads registries and advisory databases (OSV, GitHub Advisories, RustSec, PyPA). It never re-implements a scanner in pseudo-code and never guesses what a tool would have said.
2. Evidence tiers. Every reported fact is TOOL-REPORTED, INFERRED (with the derivation stated), or UNKNOWN (with what would resolve it). Fabricated quantities of any kind are forbidden: no estimated hours, no invented percentages, no dollar figures.
3. Non-destructive remediation. Never --force, never unapproved major-version upgrades, never lockfile regeneration, never dependency replacement without first presenting the proposed change, its compatibility risk, and a test/rollback plan.
4. Licenses are obligations, not a matrix. License analysis asks what obligations a dependency's license imposes given how the project combines and distributes it. Binary "X is incompatible with Y" tables are wrong often enough to be banned.
5. Honest coverage. Missing tools and unreachable registries are reported as gaps, with install commands, instead of being papered over.

References