dependency-audit

What this skill does

Automatically detects the project type (Node.js, Python, Go, container) and runs the appropriate audit tool (npm audit, pip-audit, trivy). Aggregates discovered vulnerabilities by severity and outputs recommendations including fixed versions.

When to use

• When checking dependency vulnerabilities before a code review or deployment
• When setting up an automated dependency security gate in a CI/CD pipeline
• When auditing accumulated vulnerabilities in an aging project all at once
• When scanning container images or filesystems for vulnerabilities

Prerequisites

• Node.js projects: npm installed (included with Node.js)
• Python projects: pip-audit installed:

  pip install pip-audit
  

• Container/general use: trivy installed:

  # Ubuntu/Debian
  sudo apt-get install -y wget apt-transport-https gnupg
  wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
  echo "deb https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
  sudo apt-get update && sudo apt-get install -y trivy
  

• Environment variable SECSKILL_PROJECT_PATH: project root path

Inputs

Variable	Required	Description
SECSKILL_PROJECT_PATH	Required	Project root path to audit
SECSKILL_OUTPUT_DIR	Optional	Directory to save results (default: ./output)
SECSKILL_MIN_SEVERITY	Optional	Minimum severity filter low/medium/high/critical (default: medium)
SECSKILL_TRIVY_TARGET	Optional	trivy scan target (path or image name, default: project path)

Workflow

Step 1: Environment setup and project type detection

export PROJECT="${SECSKILL_PROJECT_PATH:?Set the SECSKILL_PROJECT_PATH environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export MIN_SEV="${SECSKILL_MIN_SEVERITY:-medium}"
mkdir -p "$OUTDIR"

if [ ! -d "$PROJECT" ]; then
  echo "[-] Path not found: $PROJECT"
  exit 1
fi

echo "[*] Detecting project type: $PROJECT"

HAS_NPM=false
HAS_PYTHON=false
HAS_GO=false

[ -f "$PROJECT/package.json" ] && HAS_NPM=true && echo "[+] Node.js project detected (package.json)"
[ -f "$PROJECT/package-lock.json" ] || [ -f "$PROJECT/yarn.lock" ] && HAS_NPM=true
[ -f "$PROJECT/requirements.txt" ] || [ -f "$PROJECT/Pipfile" ] || [ -f "$PROJECT/pyproject.toml" ] && HAS_PYTHON=true && echo "[+] Python project detected"
[ -f "$PROJECT/go.mod" ] && HAS_GO=true && echo "[+] Go project detected (go.mod)"

SUMMARY_FILE="$OUTDIR/dependency_audit_summary.txt"
echo "Dependency Audit Report" > "$SUMMARY_FILE"
echo "Path : $PROJECT" >> "$SUMMARY_FILE"
echo "Date : $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$SUMMARY_FILE"
echo "" >> "$SUMMARY_FILE"