Audit Dependencies for Security and Compliance

Dependency Audit and Security Analysis is a skill for analyzing a project's dependencies for known vulnerabilities, license compliance issues, outdated packages, and supply-chain risk, producing actionable remediation strategies rather than just a list of problems.

Use it when auditing dependencies for vulnerabilities, checking license compliance or supply-chain risk, identifying outdated packages and their upgrade paths, or preparing a security report or remediation plan. It is not suited to projects with no dependency manifests to analyze, situations where dependencies can't actually be changed or updated, or tasks unrelated to dependency management.

The workflow inventories both direct and transitive dependencies, runs vulnerability and license scans against them, prioritizes fixes by severity and exposure, and proposes upgrades with compatibility notes. Output follows a fixed structure: a dependency summary and risk overview, the specific vulnerabilities and license issues found, recommended upgrades and mitigations, and any assumptions made plus follow-up tasks. Detailed tooling and templates live in a companion resources/implementation-playbook.md.

Safety guidance is explicit: never publish sensitive vulnerability details to public channels, and verify proposed upgrades in staging before rolling them out to production - an audit is not a license to auto-upgrade blindly.

Developers and security-conscious teams who need a structured, prioritized dependency audit - vulnerabilities, license conflicts, and outdated packages - with concrete upgrade recommendations rather than raw scanner output.