[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M754HA2PX9BFCE71TYFJ1H6V":3,"skill-same:01M754HA2PX9BFCE71TYFJ1H6V":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":50},"01M754HA2PX9BFCE71TYFJ1H6V","x-audit-dependencies",null,"Checks project dependencies for vulnerabilities, outdated versions, and license issues. Detects build tool automatically, runs language-specific audit commands, and generates a severity-categorized report.","review-bench\u002Federcnj_ia-dev-environment","review-bench","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F286778065?v=4","01M7517F9NTEPDZDAXJBR30FWT","ReviewBench","01M7517FAC9F4P7TGWCNJ8VYVW",0,"MIT","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-audit-dependencies\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: x-audit-dependencies\ndescription: \"Checks project dependencies for vulnerabilities, outdated versions, and license issues. Detects build tool automatically, runs language-specific audit commands, and generates a severity-categorized report.\"\nuser-invocable: true\nallowed-tools: Read, Write, Bash, Grep, Glob\nargument-hint: \"[--scope all|vulnerabilities|outdated|licenses|sbom|license-report|tree] [--policy]\"\ncontext-budget: medium\nrequires-capabilities: []\n---\n\n## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Dependency Audit\n\n## Purpose\n\nAudits all dependencies of {{PROJECT_NAME}} for security vulnerabilities, outdated versions, and license compliance. Generates a structured report with severity-categorized findings and remediation recommendations. Also supports SBOM generation, license attribution reports, and dependency tree visualization.\n\n## Triggers\n\n- `\u002Fx-audit-dependencies` — full audit (vulnerabilities + outdated + licenses)\n- `\u002Fx-audit-dependencies --scope vulnerabilities` — security vulnerabilities only\n- `\u002Fx-audit-dependencies --scope outdated` — outdated packages only\n- `\u002Fx-audit-dependencies --scope licenses` — license compliance only\n- `\u002Fx-audit-dependencies --scope sbom` — generate CycloneDX SBOM only\n- `\u002Fx-audit-dependencies --scope license-report` — generate license attribution report\n- `\u002Fx-audit-dependencies --scope tree` — generate dependency tree visualization\n- `\u002Fx-audit-dependencies --scope all --policy` — full audit + dependency policy validation (requires `dependencies.policy.enabled: true`)\n\n## Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `--scope` | Enum | `all` | Audit scope: all, vulnerabilities, outdated, licenses, sbom, license-report, tree |\n| `--policy` | Boolean | `false` | After standard audit, invoke `x-validate-dependency-policy` to enforce `DependencyPolicyConfig` (EPIC-0074, Rule 32) |\n\n## Workflow\n\n```\n1. DETECT     -> Identify build tool and package manager\n2. AUDIT      -> Run language-specific audit commands\n3. PARSE      -> Parse results into structured findings\n4. CATEGORIZE -> Assign severity to each finding\n5. REPORT     -> Generate audit report\n```\n\n### Step 1 — Detect Build Tool\n\nThe project uses **{{BUILD_TOOL}}** as its build tool. Detect the package manager and lock files:\n\n| Build Tool | Lock File | Language |\n|-----------|-----------|----------|\n| npm | package-lock.json | JavaScript\u002FTypeScript |\n| yarn | yarn.lock | JavaScript\u002FTypeScript |\n| pnpm | pnpm-lock.yaml | JavaScript\u002FTypeScript |\n| maven | pom.xml | Java\u002FKotlin |\n| gradle | build.gradle \u002F build.gradle.kts | Java\u002FKotlin |\n| cargo | Cargo.lock | Rust |\n| pip | requirements.txt \u002F Pipfile.lock | Python |\n| poetry | poetry.lock | Python |\n| go mod | go.sum | Go |\n\n### Step 2 — Run Audit Commands\n\n#### Vulnerabilities\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm audit --json` |\n| yarn | `yarn audit --json` |\n| pnpm | `pnpm audit --json` |\n| maven | `mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit` |\n| gradle | `gradle dependencyCheckAnalyze` (OWASP plugin) |\n| cargo | `cargo audit --json` |\n| pip | `pip-audit --format json` |\n| poetry | `poetry audit` |\n| go mod | `govulncheck -json .\u002F...` |\n\n#### Outdated Packages\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm outdated --json` |\n| yarn | `yarn outdated --json` |\n| pnpm | `pnpm outdated --format json` |\n| maven | `mvn versions:display-dependency-updates` |\n| gradle | `gradle dependencyUpdates` (versions plugin) |\n| cargo | `cargo outdated --format json` |\n| pip | `pip list --outdated --format json` |\n| poetry | `poetry show --outdated` |\n| go mod | `go list -m -u all` |\n\n#### License Check\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npx license-checker --json` |\n| yarn | `npx license-checker --json` |\n| maven | `mvn license:third-party-report` |\n| gradle | `gradle generateLicenseReport` (license plugin) |\n| cargo | `cargo license --json` |\n| pip | `pip-licenses --format json` |\n| go mod | `go-licenses report .\u002F...` |\n\n### Step 3 — Parse Results\n\nFor each audit dimension, extract:\n\n**Vulnerabilities:**\n```\n- Package name and version\n- CVE identifier (if available)\n- Severity (CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW)\n- Description\n- Fixed version (if available)\n- Path (dependency chain)\n```\n\n**Outdated:**\n```\n- Package name\n- Current version\n- Latest version\n- Update type (major\u002Fminor\u002Fpatch)\n- Breaking changes risk\n```\n\n**Licenses:**\n```\n- Package name\n- License type (MIT, Apache-2.0, GPL-3.0, etc.)\n- Compatibility with project license\n- Copyleft risk\n```\n\n### Step 4 — Categorize Findings\n\n| Severity | Criteria |\n|----------|----------|\n| **CRITICAL** | Known exploited CVE, RCE vulnerability, data exposure |\n| **HIGH** | CVE with CVSS >= 7.0, GPL license in proprietary project |\n| **MEDIUM** | CVE with CVSS 4.0-6.9, major version behind, LGPL license |\n| **LOW** | CVE with CVSS \u003C 4.0, minor\u002Fpatch version behind, permissive license issue |\n\n### Step 5 — Generate Report\n\nWrite report to `results\u002Faudits\u002Fdependency-audit-YYYY-MM-DD.md`:\n\n```markdown\n# Dependency Audit Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Build Tool:** {{BUILD_TOOL}}\n**Total Dependencies:** {count}\n\n## Summary\n\n| Dimension | CRITICAL | HIGH | MEDIUM | LOW | Total |\n|-----------|----------|------|--------|-----|-------|\n| Vulnerabilities | N | N | N | N | N |\n| Outdated | — | N | N | N | N |\n| Licenses | — | N | N | N | N |\n\n## Vulnerabilities\n\n### [V-001] {Package} — {CVE ID}\n- **Severity:** CRITICAL\n- **Current:** {version}\n- **Fixed:** {fixed_version}\n- **Description:** {description}\n- **Action:** `{command to update}`\n\n## Outdated Dependencies\n\n| Package | Current | Latest | Type | Risk |\n|---------|---------|--------|------|------|\n| {name} | {current} | {latest} | major | Breaking changes possible |\n| {name} | {current} | {latest} | minor | Low risk |\n\n## License Issues\n\n| Package | License | Issue |\n|---------|---------|-------|\n| {name} | GPL-3.0 | Copyleft — incompatible with project license |\n\n## Recommendations\n\n1. **Immediate:** Fix CRITICAL vulnerabilities\n2. **Short-term:** Update HIGH-risk outdated packages\n3. **Long-term:** Review license compliance strategy\n```\n\n## SBOM Generation\n\nGenerate a CycloneDX JSON Software Bill of Materials listing all direct and transitive dependencies.\n\n### SBOM Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. GENERATE   -> Run CycloneDX generation command\n3. VALIDATE   -> Verify SBOM contains required fields\n4. OUTPUT     -> Write CycloneDX JSON to results\u002Faudits\u002Fsbom-YYYY-MM-DD.json\n```\n\n### Generation Commands\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npx @cyclonedx\u002Fcdxgen -o sbom.json` |\n| maven | `mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom -DoutputFormat=json` |\n| gradle | `gradle cyclonedxBom` (cyclonedx-gradle-plugin) |\n| cargo | `cargo cyclonedx --format json` |\n| pip | `cyclonedx-py environment -o sbom.json --output-format json` |\n| poetry | `cyclonedx-py environment -o sbom.json --output-format json` |\n| go mod | `cyclonedx-gomod mod -json -output sbom.json` |\n\n### Required SBOM Fields\n\nEach component in the generated SBOM must include:\n\n```\n- name: Package name\n- version: Exact version\n- purl: Package URL (pkg:maven\u002Fgroup\u002Fartifact@version)\n- licenses[]: SPDX license identifier(s)\n- hashes[]: SHA-256 digest for integrity verification\n- scope: required | optional | excluded\n```\n\n### SBOM Output\n\nWrite CycloneDX JSON to `results\u002Faudits\u002Fsbom-YYYY-MM-DD.json` and generate a human-readable summary:\n\n```markdown\n# SBOM Summary — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Format:** CycloneDX 1.6\n**Total Components:** {count}\n\n| Type | Count |\n|------|-------|\n| Direct dependencies | N |\n| Transitive dependencies | N |\n| Dev dependencies | N |\n\n## License Distribution\n\n| License | Count | Copyleft |\n|---------|-------|----------|\n| MIT | N | No |\n| Apache-2.0 | N | No |\n| GPL-3.0 | N | Yes |\n```\n\n## License Attribution Report\n\nGenerate a comprehensive license attribution report for all dependencies, highlighting copyleft licenses that may impose obligations.\n\n### License Report Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. COLLECT    -> Gather license data for all dependencies\n3. CLASSIFY   -> Categorize by license type and copyleft risk\n4. REPORT     -> Generate attribution report\n```\n\n### License Report Output\n\nWrite report to `results\u002Faudits\u002Flicense-attribution-YYYY-MM-DD.md`:\n\n```markdown\n# License Attribution Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Total Dependencies:** {count}\n\n## Summary\n\n| Category | Count | Percentage |\n|----------|-------|------------|\n| Permissive (MIT, Apache-2.0, BSD) | N | N% |\n| Weak copyleft (LGPL, MPL, EPL) | N | N% |\n| Strong copyleft (GPL, AGPL) | N | N% |\n| Unknown \u002F Custom | N | N% |\n\n## Copyleft Dependencies (Requires Review)\n\n| Package | Version | License | Risk | Action |\n|---------|---------|---------|------|--------|\n| {name} | {version} | GPL-3.0 | HIGH | Legal review required |\n| {name} | {version} | LGPL-2.1 | MEDIUM | Check linking compatibility |\n\n## Full Attribution\n\n| Package | Version | License | URL |\n|---------|---------|---------|-----|\n| {name} | {version} | MIT | {repo_url} |\n```\n\n## Dependency Tree Visualization\n\nGenerate a visual dependency tree showing transitive relationships and risk scores.\n\n### Tree Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. RESOLVE    -> Build full dependency graph\n3. SCORE      -> Assign risk score to each node\n4. RENDER     -> Generate tree visualization\n```\n\n### Tree Commands\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm ls --all --json` |\n| maven | `mvn dependency:tree -DoutputType=text` |\n| gradle | `gradle dependencies` |\n| cargo | `cargo tree` |\n| pip | `pipdeptree --json` |\n| go mod | `go mod graph` |\n\n### Risk Scoring\n\n| Factor | Weight | Description |\n|--------|--------|-------------|\n| Known CVE | 40% | Active vulnerabilities in the dependency |\n| Depth | 20% | Distance from direct dependency (deeper = harder to update) |\n| Maintainer activity | 15% | Last update, number of maintainers |\n| License risk | 15% | Copyleft or unknown license |\n| Popularity | 10% | Download count, dependents (low = higher risk) |\n\n### Tree Output\n\nWrite tree to `results\u002Faudits\u002Fdependency-tree-YYYY-MM-DD.md`:\n\n```markdown\n# Dependency Tree — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Total Nodes:** {count}\n**Max Depth:** {depth}\n\n## Risk Summary\n\n| Risk Level | Count |\n|------------|-------|\n| HIGH (score >= 7) | N |\n| MEDIUM (score 4-6) | N |\n| LOW (score \u003C 4) | N |\n\n## Tree\n\n{package}@{version} [risk: LOW]\n├── {dep-a}@{version} [risk: LOW]\n│   ├── {transitive-1}@{version} [risk: MEDIUM]\n│   └── {transitive-2}@{version} [risk: LOW]\n└── {dep-b}@{version} [risk: HIGH]\n    └── {transitive-3}@{version} [risk: HIGH]\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Audit tool not installed | Suggest installation command, continue with available tools |\n| No lock file found | Warn and attempt audit without lock file |\n| Audit command fails | Report error, continue with other dimensions |\n| No dependencies found | Report \"No dependencies found\" |\n| Offline mode | Skip vulnerability check, proceed with outdated and license |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `x-audit-supply-chain` | complementary | Handles deeper supply chain risks (maintainer, typosquatting, SLSA) |\n| `x-generate-ci` | called-by | Dependency audit pipeline references audit commands from this skill |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-validate-dependency-policy` | delegates-to | When `--policy` flag is set, delegates policy enforcement to this skill after standard audit completes |\n\n## `--policy` Flag — Policy Validation Integration\n\nWhen `--policy` is passed:\n\n1. Execute the standard audit workflow (Steps 1-5) normally.\n2. After generating the standard audit report, invoke the policy validator:\n   ```\n   Skill(skill: \"x-validate-dependency-policy\", args: \"--story-id \u003CSTORY-ID> --report \u003Cartifact-path>\")\n   ```\n3. Propagate exit code: if `x-validate-dependency-policy` exits 1 (`DEP_POLICY_BLOCK`), this skill also exits non-zero.\n4. The standard audit report and the policy validation report are independent artifacts.\n\nThis flag is a no-op when `dependencies.policy.enabled: false` or the `governance.dependency-policy` capability is not declared in the project profile.\n","## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Dependency Audit\n\n## Purpose\n\nAudits all dependencies of {{PROJECT_NAME}} for security vulnerabilities, outdated versions, and license compliance. Generates a structured report with severity-categorized findings and remediation recommendations. Also supports SBOM generation, license attribution reports, and dependency tree visualization.\n\n## Triggers\n\n- `\u002Fx-audit-dependencies` — full audit (vulnerabilities + outdated + licenses)\n- `\u002Fx-audit-dependencies --scope vulnerabilities` — security vulnerabilities only\n- `\u002Fx-audit-dependencies --scope outdated` — outdated packages only\n- `\u002Fx-audit-dependencies --scope licenses` — license compliance only\n- `\u002Fx-audit-dependencies --scope sbom` — generate CycloneDX SBOM only\n- `\u002Fx-audit-dependencies --scope license-report` — generate license attribution report\n- `\u002Fx-audit-dependencies --scope tree` — generate dependency tree visualization\n- `\u002Fx-audit-dependencies --scope all --policy` — full audit + dependency policy validation (requires `dependencies.policy.enabled: true`)\n\n## Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `--scope` | Enum | `all` | Audit scope: all, vulnerabilities, outdated, licenses, sbom, license-report, tree |\n| `--policy` | Boolean | `false` | After standard audit, invoke `x-validate-dependency-policy` to enforce `DependencyPolicyConfig` (EPIC-0074, Rule 32) |\n\n## Workflow\n\n```\n1. DETECT     -> Identify build tool and package manager\n2. AUDIT      -> Run language-specific audit commands\n3. PARSE      -> Parse results into structured findings\n4. CATEGORIZE -> Assign severity to each finding\n5. REPORT     -> Generate audit report\n```\n\n### Step 1 — Detect Build Tool\n\nThe project uses **{{BUILD_TOOL}}** as its build tool. Detect the package manager and lock files:\n\n| Build Tool | Lock File | Language |\n|-----------|-----------|----------|\n| npm | package-lock.json | JavaScript\u002FTypeScript |\n| yarn | yarn.lock | JavaScript\u002FTypeScript |\n| pnpm | pnpm-lock.yaml | JavaScript\u002FTypeScript |\n| maven | pom.xml | Java\u002FKotlin |\n| gradle | build.gradle \u002F build.gradle.kts | Java\u002FKotlin |\n| cargo | Cargo.lock | Rust |\n| pip | requirements.txt \u002F Pipfile.lock | Python |\n| poetry | poetry.lock | Python |\n| go mod | go.sum | Go |\n\n### Step 2 — Run Audit Commands\n\n#### Vulnerabilities\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm audit --json` |\n| yarn | `yarn audit --json` |\n| pnpm | `pnpm audit --json` |\n| maven | `mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit` |\n| gradle | `gradle dependencyCheckAnalyze` (OWASP plugin) |\n| cargo | `cargo audit --json` |\n| pip | `pip-audit --format json` |\n| poetry | `poetry audit` |\n| go mod | `govulncheck -json .\u002F...` |\n\n#### Outdated Packages\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm outdated --json` |\n| yarn | `yarn outdated --json` |\n| pnpm | `pnpm outdated --format json` |\n| maven | `mvn versions:display-dependency-updates` |\n| gradle | `gradle dependencyUpdates` (versions plugin) |\n| cargo | `cargo outdated --format json` |\n| pip | `pip list --outdated --format json` |\n| poetry | `poetry show --outdated` |\n| go mod | `go list -m -u all` |\n\n#### License Check\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npx license-checker --json` |\n| yarn | `npx license-checker --json` |\n| maven | `mvn license:third-party-report` |\n| gradle | `gradle generateLicenseReport` (license plugin) |\n| cargo | `cargo license --json` |\n| pip | `pip-licenses --format json` |\n| go mod | `go-licenses report .\u002F...` |\n\n### Step 3 — Parse Results\n\nFor each audit dimension, extract:\n\n**Vulnerabilities:**\n```\n- Package name and version\n- CVE identifier (if available)\n- Severity (CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW)\n- Description\n- Fixed version (if available)\n- Path (dependency chain)\n```\n\n**Outdated:**\n```\n- Package name\n- Current version\n- Latest version\n- Update type (major\u002Fminor\u002Fpatch)\n- Breaking changes risk\n```\n\n**Licenses:**\n```\n- Package name\n- License type (MIT, Apache-2.0, GPL-3.0, etc.)\n- Compatibility with project license\n- Copyleft risk\n```\n\n### Step 4 — Categorize Findings\n\n| Severity | Criteria |\n|----------|----------|\n| **CRITICAL** | Known exploited CVE, RCE vulnerability, data exposure |\n| **HIGH** | CVE with CVSS >= 7.0, GPL license in proprietary project |\n| **MEDIUM** | CVE with CVSS 4.0-6.9, major version behind, LGPL license |\n| **LOW** | CVE with CVSS \u003C 4.0, minor\u002Fpatch version behind, permissive license issue |\n\n### Step 5 — Generate Report\n\nWrite report to `results\u002Faudits\u002Fdependency-audit-YYYY-MM-DD.md`:\n\n```markdown\n# Dependency Audit Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Build Tool:** {{BUILD_TOOL}}\n**Total Dependencies:** {count}\n\n## Summary\n\n| Dimension | CRITICAL | HIGH | MEDIUM | LOW | Total |\n|-----------|----------|------|--------|-----|-------|\n| Vulnerabilities | N | N | N | N | N |\n| Outdated | — | N | N | N | N |\n| Licenses | — | N | N | N | N |\n\n## Vulnerabilities\n\n### [V-001] {Package} — {CVE ID}\n- **Severity:** CRITICAL\n- **Current:** {version}\n- **Fixed:** {fixed_version}\n- **Description:** {description}\n- **Action:** `{command to update}`\n\n## Outdated Dependencies\n\n| Package | Current | Latest | Type | Risk |\n|---------|---------|--------|------|------|\n| {name} | {current} | {latest} | major | Breaking changes possible |\n| {name} | {current} | {latest} | minor | Low risk |\n\n## License Issues\n\n| Package | License | Issue |\n|---------|---------|-------|\n| {name} | GPL-3.0 | Copyleft — incompatible with project license |\n\n## Recommendations\n\n1. **Immediate:** Fix CRITICAL vulnerabilities\n2. **Short-term:** Update HIGH-risk outdated packages\n3. **Long-term:** Review license compliance strategy\n```\n\n## SBOM Generation\n\nGenerate a CycloneDX JSON Software Bill of Materials listing all direct and transitive dependencies.\n\n### SBOM Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. GENERATE   -> Run CycloneDX generation command\n3. VALIDATE   -> Verify SBOM contains required fields\n4. OUTPUT     -> Write CycloneDX JSON to results\u002Faudits\u002Fsbom-YYYY-MM-DD.json\n```\n\n### Generation Commands\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npx @cyclonedx\u002Fcdxgen -o sbom.json` |\n| maven | `mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom -DoutputFormat=json` |\n| gradle | `gradle cyclonedxBom` (cyclonedx-gradle-plugin) |\n| cargo | `cargo cyclonedx --format json` |\n| pip | `cyclonedx-py environment -o sbom.json --output-format json` |\n| poetry | `cyclonedx-py environment -o sbom.json --output-format json` |\n| go mod | `cyclonedx-gomod mod -json -output sbom.json` |\n\n### Required SBOM Fields\n\nEach component in the generated SBOM must include:\n\n```\n- name: Package name\n- version: Exact version\n- purl: Package URL (pkg:maven\u002Fgroup\u002Fartifact@version)\n- licenses[]: SPDX license identifier(s)\n- hashes[]: SHA-256 digest for integrity verification\n- scope: required | optional | excluded\n```\n\n### SBOM Output\n\nWrite CycloneDX JSON to `results\u002Faudits\u002Fsbom-YYYY-MM-DD.json` and generate a human-readable summary:\n\n```markdown\n# SBOM Summary — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Format:** CycloneDX 1.6\n**Total Components:** {count}\n\n| Type | Count |\n|------|-------|\n| Direct dependencies | N |\n| Transitive dependencies | N |\n| Dev dependencies | N |\n\n## License Distribution\n\n| License | Count | Copyleft |\n|---------|-------|----------|\n| MIT | N | No |\n| Apache-2.0 | N | No |\n| GPL-3.0 | N | Yes |\n```\n\n## License Attribution Report\n\nGenerate a comprehensive license attribution report for all dependencies, highlighting copyleft licenses that may impose obligations.\n\n### License Report Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. COLLECT    -> Gather license data for all dependencies\n3. CLASSIFY   -> Categorize by license type and copyleft risk\n4. REPORT     -> Generate attribution report\n```\n\n### License Report Output\n\nWrite report to `results\u002Faudits\u002Flicense-attribution-YYYY-MM-DD.md`:\n\n```markdown\n# License Attribution Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Total Dependencies:** {count}\n\n## Summary\n\n| Category | Count | Percentage |\n|----------|-------|------------|\n| Permissive (MIT, Apache-2.0, BSD) | N | N% |\n| Weak copyleft (LGPL, MPL, EPL) | N | N% |\n| Strong copyleft (GPL, AGPL) | N | N% |\n| Unknown \u002F Custom | N | N% |\n\n## Copyleft Dependencies (Requires Review)\n\n| Package | Version | License | Risk | Action |\n|---------|---------|---------|------|--------|\n| {name} | {version} | GPL-3.0 | HIGH | Legal review required |\n| {name} | {version} | LGPL-2.1 | MEDIUM | Check linking compatibility |\n\n## Full Attribution\n\n| Package | Version | License | URL |\n|---------|---------|---------|-----|\n| {name} | {version} | MIT | {repo_url} |\n```\n\n## Dependency Tree Visualization\n\nGenerate a visual dependency tree showing transitive relationships and risk scores.\n\n### Tree Workflow\n\n```\n1. DETECT     -> Identify build tool (reuse Step 1)\n2. RESOLVE    -> Build full dependency graph\n3. SCORE      -> Assign risk score to each node\n4. RENDER     -> Generate tree visualization\n```\n\n### Tree Commands\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm ls --all --json` |\n| maven | `mvn dependency:tree -DoutputType=text` |\n| gradle | `gradle dependencies` |\n| cargo | `cargo tree` |\n| pip | `pipdeptree --json` |\n| go mod | `go mod graph` |\n\n### Risk Scoring\n\n| Factor | Weight | Description |\n|--------|--------|-------------|\n| Known CVE | 40% | Active vulnerabilities in the dependency |\n| Depth | 20% | Distance from direct dependency (deeper = harder to update) |\n| Maintainer activity | 15% | Last update, number of maintainers |\n| License risk | 15% | Copyleft or unknown license |\n| Popularity | 10% | Download count, dependents (low = higher risk) |\n\n### Tree Output\n\nWrite tree to `results\u002Faudits\u002Fdependency-tree-YYYY-MM-DD.md`:\n\n```markdown\n# Dependency Tree — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Total Nodes:** {count}\n**Max Depth:** {depth}\n\n## Risk Summary\n\n| Risk Level | Count |\n|------------|-------|\n| HIGH (score >= 7) | N |\n| MEDIUM (score 4-6) | N |\n| LOW (score \u003C 4) | N |\n\n## Tree\n\n{package}@{version} [risk: LOW]\n├── {dep-a}@{version} [risk: LOW]\n│   ├── {transitive-1}@{version} [risk: MEDIUM]\n│   └── {transitive-2}@{version} [risk: LOW]\n└── {dep-b}@{version} [risk: HIGH]\n    └── {transitive-3}@{version} [risk: HIGH]\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Audit tool not installed | Suggest installation command, continue with available tools |\n| No lock file found | Warn and attempt audit without lock file |\n| Audit command fails | Report error, continue with other dimensions |\n| No dependencies found | Report \"No dependencies found\" |\n| Offline mode | Skip vulnerability check, proceed with outdated and license |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `x-audit-supply-chain` | complementary | Handles deeper supply chain risks (maintainer, typosquatting, SLSA) |\n| `x-generate-ci` | called-by | Dependency audit pipeline references audit commands from this skill |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-validate-dependency-policy` | delegates-to | When `--policy` flag is set, delegates policy enforcement to this skill after standard audit completes |\n\n## `--policy` Flag — Policy Validation Integration\n\nWhen `--policy` is passed:\n\n1. Execute the standard audit workflow (Steps 1-5) normally.\n2. After generating the standard audit report, invoke the policy validator:\n   ```\n   Skill(skill: \"x-validate-dependency-policy\", args: \"--story-id \u003CSTORY-ID> --report \u003Cartifact-path>\")\n   ```\n3. Propagate exit code: if `x-validate-dependency-policy` exits 1 (`DEP_POLICY_BLOCK`), this skill also exits non-zero.\n4. The standard audit report and the policy validation report are independent artifacts.\n\nThis flag is a no-op when `dependencies.policy.enabled: false` or the `governance.dependency-policy` capability is not declared in the project profile.\n",{"name":5,"description":7,"allowed-tools":24,"argument-hint":25,"context-budget":26,"user-invocable":27,"requires-capabilities":28},"Read, Write, Bash, Grep, Glob","[--scope all|vulnerabilities|outdated|licenses|sbom|license-report|tree] [--policy]","medium",true,[],"main","952a630c6f38d193a349d86fa18db1de8843e837","src\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-audit-dependencies",1,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment","https:\u002F\u002Fgithub.com\u002Freview-bench","https:\u002F\u002Freview-bench.ai","An open benchmark for AI code review.","2026-10-27 06:56:37",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":27},[40,43,46],{"tool":41,"command":42},"npx","npx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-dependencies",{"tool":44,"command":45},"bunx","bunx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-dependencies",{"tool":47,"command":48},"pnpm","pnpm dlx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-dependencies","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-audit-dependencies\u002FSKILL.md",[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"README.md","REFERENCE","参考文档",2183,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-audit-dependencies\u002FREADME.md",[58,65,72,79,86,93],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M757M8J48TQ1Y3X25GSJBXAS","x-parallel-eval","Detects and classifies file-collision risks between work units (tasks, stories, or epic phases) before parallel execution. Reads ## File Footprint blocks produced by x-task-plan \u002F x-story-plan, applies the parallelism-heuristics knowledge pack (hard \u002F regen \u002F soft categories + hotspot overrides), and emits a collision matrix + serialization recommendation in Markdown (default) or JSON.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fx-parallel-eval\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M757M57XMR9546S69466HDWT","parallelism-heuristics","Canonical catalog of file-collision heuristics for parallel task, story, and epic execution. Defines the File Footprint block format, the three Conflict Categories (hard \u002F regen \u002F soft), a hotspot list of high-contention paths, and the degrade-with-warning policy. Consumed by x-task-plan, x-story-plan, x-epic-map, x-parallel-eval, and x-dev-*-implement.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fparallelism-heuristics\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M757M11SZ8P1VCQABT08QVYA","x-watch-pr-ci","Polls a PR's CI checks and Copilot review status, blocking until checks complete or timeout. Returns one of 8 stable exit codes (SUCCESS=0, CI_PENDING_PROCEED=10, CI_FAILED=20, TIMEOUT=30, PR_ALREADY_MERGED=40, NO_CI_CONFIGURED=50, PR_CLOSED=60, PR_NOT_FOUND=70). Writes a versioned state-file for session resume.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-watch-pr-ci\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M757KW53K8KFPGADFB4PH949","x-validate-docs","Documentation freshness gate: validates 6 dimensions (readme, api-specs, grpc-proto, adr, skill-docs, system-architecture) against code changes in a PR. Stack-aware — only validates targets declared\u002Fauto-detected from ProjectConfig.documentation.targets. Returns exit non-zero on staleness; produces structured report.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-validate-docs\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M757KQZHSA10MKC0CR571D60","x-update-system-architecture","Incrementally updates docs\u002Farchitecture\u002Fsystem.md after an epic completes. Appends new entries to the Decision Log (§11) using x-internal-write-report --append (dedup by ## ID: marker) and surgically inserts component\u002Fintegration changes into sections 1-10 via Edit. Idempotent: re-running with the same epic produces a byte-identical system.md.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-system-architecture\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M757KKBT5Q1SVF8DMJBVF46M","x-update-architecture","Incrementally updates the service architecture document with changes from architecture plans. Adds new components, integrations, flows, and ADR references without rewriting existing content. Use after implementation to keep architecture documentation current.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-architecture\u002FSKILL.md",[],[]]