Analyzing Dependencies

Overview

Run the existing dependency checker against a user-selected project root, or normalize an existing audit report. Preserve known findings, unknown severity, and incomplete coverage separately. The bundled scanner supports npm, Python requirements, Composer, Bundler and Cargo. It does not implement Go auditing, outdated-version research, recursive workspace discovery or automatic fixes.

Prerequisites

Identify the target project directory before running anything. The current working directory selects the project; ${CLAUDE_SKILL_DIR} locates this skill's bundled resources and is not the target project directory.

Python 3.10+ runs the bundled scripts. Live scanning additionally requires the selected audit executables already installed and advisory access permitted by the operator. Audit requests can disclose package names and versions to configured services. Confirm the intended project, registry/database configuration and permission to make those requests. Do not install tools, generate locks, resolve requirements, upgrade dependencies or run repair commands automatically.

Workflow

1. Use Glob to locate root manifests, Read to inspect them and Grep to find relevant configuration keys without printing credentials. Read the selected root manifests and identify supported ecosystems. npm, Composer, Bundler and Cargo require an existing lock file. Python requires an explicit pinned requirements.txt; pyproject.toml or Pipfile alone is not sufficient. Unsupported or unavailable coverage is unassessed, never clean.
2. Prefer an existing report when live access is unnecessary. Run the bundled formatter with --input; inspect its complete/status/errors fields and exit status. A valid format is not a finding-free result.
3. If live scanning is authorized, invoke scripts/dependency_check.sh from the project root with --tool npm|pip|composer|bundler|cargo, or omit --tool to select supported root manifests. Preserve the report and process exit status. The wrapper executes each selected audit once, without installing or fixing.
4. Read findings and errors together. Native errors, missing tools, invalid JSON, timeouts, skipped Python dependencies, unavailable advisory sources and contradictory counts produce incomplete coverage. Partial findings remain actionable even when another ecosystem fails.
5. Preserve identifiers and severity supplied by the report. Missing severity is UNKNOWN and remains visible. Do not invent CVEs, installed versions, CVSS scores, dependency paths or patched releases. Verify remediation against the actual advisory before proposing a change; do not execute upgrades here.
6. When requested, inventory license declarations with the bundled license checker. npm uses the installed tree; Python requires an e…