Dependency Audit

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass, no license.

Audit 0.4.1 · source sha dd4da722e22a · 18 Oct 2026Report an issue or request a re-scan

• Publisheragulli GitHub userOwner of the repository this skill is read from
• Source folderagulli/atlas-agents/ch09_agent_skills/skills/dependency-auditThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdictdd4da722e22aA new audit runs when the source changes
• Repository statusNot archivedLast push 93 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.

---
name: dependency-audit
description: Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.
license: MIT
compatibility: Requires pip or npm/yarn/pnpm
---

## Process

1. **Identify the package manager.** Look for:
   - `requirements.txt` / `pyproject.toml` / `Pipfile` → Python (pip/uv)
   - `package.json` → Node.js (npm/yarn/pnpm)
   - `go.mod` → Go
   - `Cargo.toml` → Rust

2. **Run vulnerability scan.**
   - Python: `pip audit` or `uvx pip-audit`
   - Node.js: `npm audit` or `npx better-npm-audit audit`
   - Go: `govulncheck ./...`

3. **Check for outdated packages.**
   - Python: `pip list --outdated`
   - Node.js: `npm outdated`

4. **License audit.** Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:
   - Python: `uvx pip-licenses --order=license`
   - Node.js: `npx license-checker --summary`

5. **Identify unused dependencies.**
   - Python: Check each import with `grep -r "import <package>" src/`
   - Node.js: `npx depcheck`

6. **Write the report** as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).

## Rationalizations

| Excuse | Rebuttal |
|--------|----------|
| "We'll update dependencies later" | Known vulnerabilities are actively exploited. Flag them now. |
| "It's a dev dependency, it doesn't matter" | Dev dependencies run in CI and on developer machines — they are attack surface. |
| "Removing unused deps might break something" | If nothing imports it, nothing uses it. Remove it. |

## Verification

- [ ] Vulnerability scan was executed (not estimated)
- [ ] Every critical/high vulnerability has a recommended action (update version or replace package)
- [ ] License compatibility was checked against the project's license

Excerpt, first 1,905 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/agulli/atlas-agents
git -C atlas-agents checkout dd4da722e22a

Works in

1. 2026-10-18
   ✓SAFE B 89 / 100

   first audit · source dd4da722e22a

Questions about Dependency Audit

• github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skill — the audited source at commit dd4da722e22a and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology