Dependency Audit Skill

Your dependencies are your attack surface. Log4Shell, colors.js, event-stream — high-severity supply chain incidents keep happening. This skill covers systematic dependency security and license compliance.

When to Activate

• Running a security audit before a release
• Responding to a reported CVE in a dependency
• Setting up automated dependency updates (Renovate/Dependabot)
• License compliance review before open-sourcing or commercial distribution
• Investigating a suspicious transitive dependency
• Verifying that internal package names are protected against dependency confusion attacks
• Adding automated vulnerability scanning to a CI/CD pipeline for the first time

Vulnerability Scanning by Language

Node.js / npm