dependency-audit

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' 'is this package safe,' or needs to check whether their stack has known security issues.

Quality

85%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

Quality

Content

70%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a highly actionable and well-structured dependency audit skill with excellent workflow clarity and concrete, executable guidance across many ecosystems. Its main weakness is extreme length — the monolithic structure with no progressive disclosure means it consumes a large context window every time it's loaded, and much of the framework-specific content could be split into separate reference files loaded on demand. Some sections also explain concepts Claude already knows (basic anti-patterns, what typosquatting is).

Suggestions

Split framework-specific patterns (Next.js, Django, Rails, Express, Spring, Laravel, WordPress) into separate files (e.g., frameworks/nextjs.md) and reference them from the main SKILL.md with one-line summaries

Move the supply chain risks checklist and CI/CD security sections into separate reference files to reduce the main file to a concise overview with clear pointers

Trim explanatory text that Claude already knows — e.g., remove the definition of typosquatting, the explanation of what optionalDependencies are, and basic concepts like 'DEBUG=True leaks info' — keep only the actionable grep/check patterns

Consider condensing the package manifest listing into a single line per ecosystem rather than a formatted code block, since Claude already knows where to find dependency files

Dimension	Reasoning	Score
Conciseness	The skill is comprehensive and most content earns its place, but there's notable verbosity in areas Claude already knows (e.g., listing every package manifest format, explaining what typosquatting is, listing basic framework anti-patterns like DEBUG=True). The framework-specific sections are extensive and could be trimmed or moved to separate files. However, the actionable details like the `npm audit fix --force` downgrade warning and serverless rate-limiting pitfalls add genuine value.	2 / 3
Actionability	The skill provides fully executable commands for every ecosystem (npm audit --json, pip audit, govulncheck, trivy, etc.), concrete bash commands, specific grep patterns to find issues, and detailed remediation steps. The `npm audit fix --dry-run --force` workflow and lockfile verification commands are copy-paste ready. Framework-specific issues include concrete code patterns to search for.	3 / 3
Workflow Clarity	The 5-step methodology is clearly sequenced (Inventory → Automated Audit → Framework Research → Supply Chain → CI/CD), with explicit validation checkpoints throughout. Step 2 includes a careful dry-run-before-force workflow with error recovery. The output format provides a structured template with severity-based prioritization. The distinction between runtime/build-only/dev-only reachability adds a meaningful triage checkpoint.	3 / 3
Progressive Disclosure	This is a monolithic wall of text (~300+ lines) with no references to supporting files. The framework-specific patterns (Next.js, Django, Rails, Express, Spring, Laravel, WordPress) each deserve their own reference file. The supply chain risks, CI/CD security, and output format sections could also be split out. With no bundle files provided, everything is crammed into a single document that would consume significant context window.	1 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that hits all the marks. It provides specific concrete actions, comprehensive natural trigger terms covering both technical jargon and conversational phrasing, explicit 'Use when' guidance, and a clearly defined niche that minimizes conflict with other skills. The description uses proper third-person voice throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: audit dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. These are specific, actionable capabilities.	3 / 3
Completeness	Clearly answers both 'what' (audit project dependencies, frameworks, languages, and dev tools for vulnerabilities, CVEs, and security anti-patterns) and 'when' (explicit 'Use when' clause with extensive trigger terms and a general fallback condition).	3 / 3
Trigger Term Quality	Excellent coverage of natural trigger terms including 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' and the conversational 'is this package safe.'	3 / 3
Distinctiveness Conflict Risk	Highly distinctive niche focused on security vulnerability auditing of dependencies and supply chain. The specific trigger terms like 'CVE,' 'npm audit,' 'supply chain security,' and 'security advisory' clearly distinguish it from general code review or dependency management skills.	3 / 3
	Total	12 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning

	Total	10 / 11 Passed

Repository: briiirussell/cybersecurity-skills
Commit: c9ade03

Reviewed: 26 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.