What problem does it solve? Shipping software with vulnerable, abandoned, or improperly licensed dependencies creates security and legal exposure. This Skill runs a structured dependency hygiene pass across any stack so issues are found before production, not after. ## Core Features & Use Cases - Vulnerability Scanning: Runs the stack-native audit tool (pip-audit, cargo audit, govulncheck, bundle-audit, npm audit) and triages findings by severity with fix versions. - License Review: Classifies dependency licenses as permissive, copyleft, or problematic against a baseline policy, flagging GPL/AGPL and unknown licenses for review. - Staleness and Pinning Checks: Detects abandoned packages, major-version lag, open version ranges, and missing or stale lock files. - Use Case: Before a release, run the audit on a repo containing both package.json and requirements.txt to get one prioritized report covering CVEs, license flags, and unpinned dependencies across both ecosystems. ## Quick Start Run a dependency audit on this repository and report vulnerabilities, license issues, and outdated packages.
