dependency-auditor

原文涵盖的主题

• Dependency Auditor
• Quick Start
• Supported Ecosystems
• License Classification
• Upgrade Risk Matrix
• Scripts (accurate capability claims)
• CI Integration
• Best Practices

Skill Type: POWERFUL · Category: Engineering · Domain: Dependency Management & Security Offline, deterministic dependency auditing across 8+ package ecosystems. The three scripts are pattern-matchers over manifests/lockfiles — they do not call live advisory APIs; pair their findings with npm audit / pip-audit / cargo audit for current CVE coverage. Consume the outputs: scan.json findings drive which packages to pin/patch now; licenses.json conflicts go to the user as a legal-risk list; plan.json orders upgrades by risk with rollback notes. --quick-scan skips transitive deps; --security-only limits the plan to security fixes. Verification loop: after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit. | Language | Manifests parsed | |---|---| | JavaScript/Node | package.json, package-lock.json, yarn.lock | | Python | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock | | Go | go.mod, go.sum | | Rust | Cargo.toml, Cargo.lock | | Ruby | Gemfile, Gemfile.lock | | Java | pom.xml, gradle.lockfile | | PHP | composer.json, composer.lock | | C#/.NET | packages.config, project.assets.json | Permissive: MIT, Apache 2.0, BSD (2/3-clause), ISC

这里只展示节选，请以完整原文和当前要求为准。