Dependency & Security Audit

Activation Contract

Use this skill to audit a project's technical security posture: vulnerable dependencies, stale runtimes, committed secrets, and logging/observability health.

Do not use it for penetration testing, exploit work, or code-level secure-coding review of individual classes (java-secure-coding covers that per file).

Hard Rules

• Read-only commands only: audit and dependency-tree listings. Never install tools, never modify manifests or lockfiles, never run fix/upgrade commands.
• Every command-backed result cites the command that produced it.
• When a command is unavailable or denied, degrade to manifest/lockfile inspection and mark the result method: manifest-fallback — reduced confidence, never a failure.
• Findings are ranked by severity with CVE/advisory IDs when known; unverifiable versions are flagged as unknown, not guessed.

Audit Checklist