[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M797TSNSCE5B12RWSWFBDFBW":3,"skill-same:01M797TSNSCE5B12RWSWFBDFBW":54},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":34,"repositoryHtmlUrl":35,"repositoryHomepageUrl":6,"ownerHtmlUrl":36,"ownerBlogUrl":37,"ownerDescription":38,"updatedAt":39,"install":40,"resources":53},"01M797TSNSCE5B12RWSWFBDFBW","analyzing-dependencies",null,"Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity--dependency-checker--analyzing-dependencies\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: analyzing-dependencies\ndescription: Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.\nversion: 1.0.0\nallowed-tools: \"Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)\"\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\ntags: [security, audit, analyzing-dependencies]\n---\n# Analyzing Dependencies\n\n## Overview\n\nAnalyze project dependencies for known security vulnerabilities, outdated\nversions, and license compliance issues across multiple package ecosystems.\nThis skill inspects npm, pip, Composer, Gem, Go module, and Cargo manifests\nand lock files, cross-references findings against CVE databases, and produces\nactionable remediation guidance with upgrade paths.\n\n## Prerequisites\n\n- Access to the target project directory and manifest files in `${CLAUDE_SKILL_DIR}\u002F`\n- At least one package manager CLI available: `npm`, `pip`\u002F`pip-audit`, `composer`, `gem`, `go`, or `cargo`\n- Network access for querying vulnerability databases (NVD, GitHub Advisory Database, OSV)\n- Reference: `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md` for npm\u002Fpip audit report formats, license compatibility matrix, and dependency management best practices\n\n## Instructions\n\n1. Detect the project ecosystem by scanning `${CLAUDE_SKILL_DIR}\u002F` for manifest files: `package.json` and `package-lock.json` (npm\u002FNode.js), `requirements.txt`\u002F`pyproject.toml`\u002F`Pipfile.lock` (Python), `composer.json`\u002F`composer.lock` (PHP), `Gemfile`\u002F`Gemfile.lock` (Ruby), `go.mod`\u002F`go.sum` (Go), `Cargo.toml`\u002F`Cargo.lock` (Rust).\n2. For npm projects, run `npm audit --json` and parse the structured output. Map each advisory to its CVE identifier, CVSS score, severity level, vulnerable version range, and patched version.\n3. For Python projects, run `pip-audit --format=json` or parse `safety check --json` output. Cross-reference each vulnerability against the OSV database for additional context.\n4. For other ecosystems, run the equivalent audit command (`composer audit`, `bundle audit`, `cargo audit`, `govulncheck`) and normalize the output to a common finding format.\n5. Analyze the dependency tree for transitive vulnerabilities -- identify which direct dependency pulls in the vulnerable transitive dependency, and whether upgrading the direct dependency resolves the issue.\n6. Check for outdated packages by comparing installed versions against the latest available versions. Categorize updates as patch (safe), minor (likely safe), or major (breaking changes possible).\n7. Audit license compliance by extracting license declarations from each dependency. Flag packages using copyleft licenses (GPL, AGPL) in proprietary projects, packages with no declared license, and packages with license conflicts per the compatibility matrix in `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md`.\n8. Identify abandoned or unmaintained packages: flag dependencies with no releases in over 2 years, archived repositories, or known deprecation notices.\n9. Classify each finding by severity (critical, high, medium, low) using CVSS scores: critical >= 9.0, high >= 7.0, medium >= 4.0, low \u003C 4.0.\n10. Generate a remediation plan with specific upgrade commands, alternative packages for abandoned dependencies, and a priority order based on severity and exploitability.\n\n## Output\n\n- **Vulnerability report**: Table with columns: Package, Installed Version, Vulnerability (CVE ID), CVSS Score, Severity, Patched Version, Direct\u002FTransitive\n- **Outdated packages**: Table with columns: Package, Current Version, Latest Version, Update Type (patch\u002Fminor\u002Fmajor), Breaking Changes Risk\n- **License audit**: Table with columns: Package, License, Compatibility Status (OK, Warning, Conflict), Notes\n- **Dependency tree visualization**: For critical vulnerabilities, the chain from direct dependency to vulnerable transitive dependency\n- **Remediation commands**: Ready-to-run commands (e.g., `npm install package@version`, `pip install --upgrade package==version`) prioritized by severity\n- **Executive summary**: Total dependencies scanned, total vulnerabilities by severity, outdated count, license conflicts count\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| `npm audit` returns exit code 1 | Vulnerabilities found (expected behavior) | Parse the JSON output normally; exit code 1 indicates findings, not a tool failure |\n| `pip-audit` not installed | Tool not available in the environment | Install with `pip install pip-audit` or fall back to manual `pip list --outdated` combined with OSV API queries |\n| Lock file missing or outdated | Dependencies not properly locked | Run `npm install`, `pip freeze`, or equivalent to generate\u002Fupdate the lock file before scanning |\n| Network timeout querying vulnerability DB | Firewall or connectivity issue | Retry with increased timeout; fall back to offline analysis of lock file versions against cached CVE data |\n| Mixed ecosystem project | Multiple manifest files in one repo | Scan each ecosystem independently and combine results into a unified report |\n| Private registry packages not found | Audit tools cannot resolve private packages | Skip private packages in the vulnerability scan; note them as \"unverifiable\" in the report |\n\n## Examples\n\n### npm Pre-Deployment Audit\n\nRun `npm audit --json` in `${CLAUDE_SKILL_DIR}\u002F`. Parse the output to identify critical\nand high severity advisories. For each, trace the dependency chain from direct\ndependency to vulnerable package. Produce upgrade commands:\n`npm install express@4.19.2` to resolve CVE-2024-XXXXX in `path-to-regexp`.\nFlag any advisory without a fix available as requiring a workaround or alternative package.\n\n### Python Dependency Security Check\n\nRun `pip-audit --format=json -r ${CLAUDE_SKILL_DIR}\u002Frequirements.txt`. Map each\nvulnerability to its CVE, CVSS score, and fixed version. For transitive\ndependencies, identify the direct dependency pulling in the vulnerable package.\nRecommend pinning to safe versions in `requirements.txt` and adding\n`pip-audit` to the CI pipeline.\n\n### License Compliance Scan\n\nExtract licenses from `${CLAUDE_SKILL_DIR}\u002Fnode_modules\u002F` using `license-checker --json`\nor equivalent. Flag any GPL-3.0 or AGPL-3.0 licensed package used in a\nproprietary application as a license conflict. Flag packages with `UNLICENSED`\nor missing license fields as requiring legal review before production use.\n\n## Resources\n\n- [OWASP Dependency-Check](https:\u002F\u002Fowasp.org\u002Fwww-project-dependency-check\u002F)\n- [National Vulnerability Database (NVD)](https:\u002F\u002Fnvd.nist.gov\u002F)\n- [GitHub Advisory Database](https:\u002F\u002Fgithub.com\u002Fadvisories)\n- [OSV: Open Source Vulnerabilities](https:\u002F\u002Fosv.dev\u002F)\n- [SPDX License List](https:\u002F\u002Fspdx.org\u002Flicenses\u002F)","# Analyzing Dependencies\n\n## Overview\n\nAnalyze project dependencies for known security vulnerabilities, outdated\nversions, and license compliance issues across multiple package ecosystems.\nThis skill inspects npm, pip, Composer, Gem, Go module, and Cargo manifests\nand lock files, cross-references findings against CVE databases, and produces\nactionable remediation guidance with upgrade paths.\n\n## Prerequisites\n\n- Access to the target project directory and manifest files in `${CLAUDE_SKILL_DIR}\u002F`\n- At least one package manager CLI available: `npm`, `pip`\u002F`pip-audit`, `composer`, `gem`, `go`, or `cargo`\n- Network access for querying vulnerability databases (NVD, GitHub Advisory Database, OSV)\n- Reference: `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md` for npm\u002Fpip audit report formats, license compatibility matrix, and dependency management best practices\n\n## Instructions\n\n1. Detect the project ecosystem by scanning `${CLAUDE_SKILL_DIR}\u002F` for manifest files: `package.json` and `package-lock.json` (npm\u002FNode.js), `requirements.txt`\u002F`pyproject.toml`\u002F`Pipfile.lock` (Python), `composer.json`\u002F`composer.lock` (PHP), `Gemfile`\u002F`Gemfile.lock` (Ruby), `go.mod`\u002F`go.sum` (Go), `Cargo.toml`\u002F`Cargo.lock` (Rust).\n2. For npm projects, run `npm audit --json` and parse the structured output. Map each advisory to its CVE identifier, CVSS score, severity level, vulnerable version range, and patched version.\n3. For Python projects, run `pip-audit --format=json` or parse `safety check --json` output. Cross-reference each vulnerability against the OSV database for additional context.\n4. For other ecosystems, run the equivalent audit command (`composer audit`, `bundle audit`, `cargo audit`, `govulncheck`) and normalize the output to a common finding format.\n5. Analyze the dependency tree for transitive vulnerabilities -- identify which direct dependency pulls in the vulnerable transitive dependency, and whether upgrading the direct dependency resolves the issue.\n6. Check for outdated packages by comparing installed versions against the latest available versions. Categorize updates as patch (safe), minor (likely safe), or major (breaking changes possible).\n7. Audit license compliance by extracting license declarations from each dependency. Flag packages using copyleft licenses (GPL, AGPL) in proprietary projects, packages with no declared license, and packages with license conflicts per the compatibility matrix in `${CLAUDE_SKILL_DIR}\u002Freferences\u002FREADME.md`.\n8. Identify abandoned or unmaintained packages: flag dependencies with no releases in over 2 years, archived repositories, or known deprecation notices.\n9. Classify each finding by severity (critical, high, medium, low) using CVSS scores: critical >= 9.0, high >= 7.0, medium >= 4.0, low \u003C 4.0.\n10. Generate a remediation plan with specific upgrade commands, alternative packages for abandoned dependencies, and a priority order based on severity and exploitability.\n\n## Output\n\n- **Vulnerability report**: Table with columns: Package, Installed Version, Vulnerability (CVE ID), CVSS Score, Severity, Patched Version, Direct\u002FTransitive\n- **Outdated packages**: Table with columns: Package, Current Version, Latest Version, Update Type (patch\u002Fminor\u002Fmajor), Breaking Changes Risk\n- **License audit**: Table with columns: Package, License, Compatibility Status (OK, Warning, Conflict), Notes\n- **Dependency tree visualization**: For critical vulnerabilities, the chain from direct dependency to vulnerable transitive dependency\n- **Remediation commands**: Ready-to-run commands (e.g., `npm install package@version`, `pip install --upgrade package==version`) prioritized by severity\n- **Executive summary**: Total dependencies scanned, total vulnerabilities by severity, outdated count, license conflicts count\n\n## Error Handling\n\n| Error | Cause | Solution |\n|-------|-------|----------|\n| `npm audit` returns exit code 1 | Vulnerabilities found (expected behavior) | Parse the JSON output normally; exit code 1 indicates findings, not a tool failure |\n| `pip-audit` not installed | Tool not available in the environment | Install with `pip install pip-audit` or fall back to manual `pip list --outdated` combined with OSV API queries |\n| Lock file missing or outdated | Dependencies not properly locked | Run `npm install`, `pip freeze`, or equivalent to generate\u002Fupdate the lock file before scanning |\n| Network timeout querying vulnerability DB | Firewall or connectivity issue | Retry with increased timeout; fall back to offline analysis of lock file versions against cached CVE data |\n| Mixed ecosystem project | Multiple manifest files in one repo | Scan each ecosystem independently and combine results into a unified report |\n| Private registry packages not found | Audit tools cannot resolve private packages | Skip private packages in the vulnerability scan; note them as \"unverifiable\" in the report |\n\n## Examples\n\n### npm Pre-Deployment Audit\n\nRun `npm audit --json` in `${CLAUDE_SKILL_DIR}\u002F`. Parse the output to identify critical\nand high severity advisories. For each, trace the dependency chain from direct\ndependency to vulnerable package. Produce upgrade commands:\n`npm install express@4.19.2` to resolve CVE-2024-XXXXX in `path-to-regexp`.\nFlag any advisory without a fix available as requiring a workaround or alternative package.\n\n### Python Dependency Security Check\n\nRun `pip-audit --format=json -r ${CLAUDE_SKILL_DIR}\u002Frequirements.txt`. Map each\nvulnerability to its CVE, CVSS score, and fixed version. For transitive\ndependencies, identify the direct dependency pulling in the vulnerable package.\nRecommend pinning to safe versions in `requirements.txt` and adding\n`pip-audit` to the CI pipeline.\n\n### License Compliance Scan\n\nExtract licenses from `${CLAUDE_SKILL_DIR}\u002Fnode_modules\u002F` using `license-checker --json`\nor equivalent. Flag any GPL-3.0 or AGPL-3.0 licensed package used in a\nproprietary application as a license conflict. Flag packages with `UNLICENSED`\nor missing license fields as requiring legal review before production use.\n\n## Resources\n\n- [OWASP Dependency-Check](https:\u002F\u002Fowasp.org\u002Fwww-project-dependency-check\u002F)\n- [National Vulnerability Database (NVD)](https:\u002F\u002Fnvd.nist.gov\u002F)\n- [GitHub Advisory Database](https:\u002F\u002Fgithub.com\u002Fadvisories)\n- [OSV: Open Source Vulnerabilities](https:\u002F\u002Fosv.dev\u002F)\n- [SPDX License List](https:\u002F\u002Fspdx.org\u002Flicenses\u002F)",{"name":5,"tags":24,"author":27,"license":15,"version":28,"description":7,"allowed-tools":29,"compatible-with":30},[25,26,5],"security","audit","Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)","claude-code, codex, openclaw","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fsecurity--dependency-checker--analyzing-dependencies",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-dependencies",{"tool":46,"command":47},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-dependencies",{"tool":49,"command":50},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-dependencies","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity--dependency-checker--analyzing-dependencies\u002FSKILL.md",true,[],[55,62,69,76,83,91],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":19},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":19},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":19},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":19},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":87,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":19},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]