deps

thoreinstein's avatarfrom thoreinstein

Analyze dependencies for security vulnerabilities, outdated packages, and license compliance

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 29, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill is a comprehensive dependency analysis tool designed to enhance software supply chain security. It automates the detection of security vulnerabilities (CVEs), identifies outdated packages to manage technical debt, and ensures open-source license compliance. By integrating tools like govulncheck and npm audit, it provides developers with actionable insights and automatically documents findings into Obsidian for streamlined project maintenance.

Use Cases

  • Vulnerability Management: Automatically scan Go and JavaScript projects for known security flaws and cross-reference them with CVE databases to assess exploitability.
  • Dependency Lifecycle Tracking: Identify outdated direct and indirect dependencies, categorize them by update risk, and review changelogs for breaking changes.
  • Compliance Auditing: Conduct thorough license checks across the entire dependency tree to ensure all third-party software meets legal and corporate policy requirements.
  • Automated Security Documentation: Generate and append detailed audit reports to an Obsidian vault, creating a searchable history of project health and security posture.
namedeps
descriptionAnalyze dependencies for security vulnerabilities, outdated packages, and license compliance

Dependency Analysis & Management

Current Time: !date Go Version: !go version

Analyze project dependencies for security vulnerabilities, outdated packages, and license compliance. Documents findings to Obsidian.

Input

  • Scope: full audit, security-only, updates-only, or licenses-only
  • Optional: specific package to investigate
  • Optional: target version constraints

Investigation Strategy

Launch parallel investigation tracks:

Track 1: Security Analysis

  • Run govulncheck for Go vulnerabilities
  • Run npm audit for JavaScript vulnerabilities
  • Cross-reference with CVE databases
  • Assess severity and exploitability

Track 2: Update Analysis

  • Check for outdated direct dependencies
  • Identify major version updates (breaking changes)
  • Review changelogs for significant updates
  • Assess update risk and effort

Track 3: External Research (librarian agent)

  • Research CVE details and exploit availability
  • Find migration guides for major updates
  • Check for known issues with newer versions
  • Identify deprecated packages needing replacement

Output

Write to Obsidian via obsidian_append_content at: $OBSIDIAN_PATH/Dependencies/YYYY-MM-DD-audit.md

Note: $OBSIDIAN_PATH must be a vault-relative path (e.g., Projects/myapp), set per-project via direnv. The obsidian_append_content tool expects paths relative to the vault root.

Document Structure

Use this template for the Obsidian document:

@~/.config/opencode/templates/deps-audit.md

Behavior

  1. Detect project type(s) from manifest files (go.mod, package.json)
  2. Run security scanners (govulncheck, npm audit)
  3. Analyze outdated dependencies and categorize by risk
  4. Check license compliance for all dependencies
  5. Launch librarian agent for CVE research on critical/high findings
  6. Generate prioritized action items
  7. Write audit report to Obsidian via obsidian_append_content with auto-generated filename: YYYY-MM-DD-audit.md

Commands Reference

Go

# Vulnerability check
govulncheck ./...

# List outdated (requires go-mod-outdated)
go list -u -m all | go-mod-outdated

# Tidy dependencies
go mod tidy

# Verify checksums
go mod verify

JavaScript

# Security audit
npm audit
npm audit --json

# Outdated packages
npm outdated

# License check (requires license-checker)
npx license-checker --summary

$ARGUMENTS