Dependency Audit

Dependency Audit

扫描项目依赖，检测安全漏洞、过时包和 license 合规问题。

Overview

全面审计项目依赖：CVE 漏洞扫描、过时依赖检测、license 合规检查、重复依赖分析。输出按严重程度排序的安全报告和可执行的修复命令。

When to Use

• User wants to check dependency security
• User mentions CVE, vulnerability, or audit
• User wants to know outdated dependencies
• User says "审计依赖" / "check dependencies"
• User inputs /dependency-audit

When NOT to Use:

• User only wants to update versions
• User wants code-level security review
• User wants to analyze runtime dependencies
• User wants deep license analysis
• User wants to scan Docker images

Core Pattern

Step 1: 检测包管理器

Step 2: 漏洞扫描

# 工具可用性检查
check_tool() {
  command -v "$1" >/dev/null 2>&1 || { echo "⚠️ $1 未安装，跳过 $2 审计"; return 1; }
}

# npm
if check_tool "npm" "npm"; then
  npm audit --json 2>/dev/null | python3 -c "
import sys,json
data=json.load(sys.stdin)
vulns=data.get('vulnerabilities',{})
print(f'Total: {len(vulns)} vulnerabilities')
for name,v in vulns.items():
    via=v.get('via',[])
    title=next((x.get('title','') for x in via if isinstance(x,dict) and x.get('title')),'')
    print(f'  {name}: {v.get(\"severity\",\"unknown\")} - {title}')
" || echo "npm audit 失败，尝试: npm audit fix"
fi

# Go
if check_tool "go" "Go"; then
  go install golang.org/x/vuln/cmd/govulncheck@latest 2>/dev/null
  $(go env GOPATH)/bin/govulncheck ./... 2>/dev/null || echo "govulncheck 失败，检查 Go 版本"
fi

# Python
if check_tool "pip-audit" "Python"; then
  pip-audit 2>/dev/null; rc=$?; if [ $rc -gt 1 ]; then echo "pip-audit 执行失败 (exit $rc)，尝试: pip install pip-audit"; fi
else
  echo "安装 pip-audit: pip install pip-audit"
fi

Step 3: 过时依赖检测

# npm
if command -v npx >/dev/null 2>&1; then
  npx npm-check-updates --format table 2>/dev/null || echo "npm-check-updates 失败"
else
  echo "⚠️ npx 未安装，跳过 npm 过时检测"
fi

# Go
if command -v go >/dev/null 2>&1; then
  go list -m -u all 2>/dev/null | grep "\[" || echo "无过时依赖"
else
  echo "⚠️ go 未安装，跳过 Go 过时检测"
fi

# Python
if command -v pip >/dev/null 2>&1; then
  pip list --outdated 2>/dev/null || echo "pip list 失败"
else
  echo "⚠️ pip 未安装，跳过 Python 过时检测"
fi

统计：

• 过时依赖数量
• major / minor / patch 升级分布
• 是否有安全相关的更新

Step 4: License 合规检查

# npm
if command -v npx >/dev/null 2>&1; then
  npx license-checker --json 2>/dev/null | python3 -c "
import sys,json
data=json.load(sys.stdin)
licenses={}
for k,v in data.items():
    lic=v.get('licenses','UNKNOWN')
    licenses[lic]=licenses.get(lic,0)+1
for l,c in sorted(licenses.items(),key=lambda x:-x[1]):
    print(f'  {l}: {c}')
" || echo "license-checker 失败"
else
  echo "⚠️ npx 未安装，跳过 npm license 检查"
fi

# Go
if command -v go-licenses >/dev/null 2>&1; then
  go-licenses csv . 2>/dev/null || echo "go-licenses 失败"
else
  echo "⚠️ go-licenses 未安装，跳过 Go license 检查"
  echo "安装: go install github.com/google/go-licenses@latest"
fi

检测：

• 是否有 GPL/AGPL 等 copyleft 许可证
• 是否有未知/自定义许可证
• 许可证兼容性

Step 5: 生成报告

使用 templates/audit-report.md 模板，输出：

1. 安全概览 — 漏洞数量和严重程度分布 2. 高危漏洞 — 需要立即修复的 CVE 3. 过时依赖 — 按升级难度排序 4. License 合规 — 风险许可证列表 5. 修复命令 — 每个问题附带可执行命令

Quick Reference

/dependency-audit                    # 完整审计
/dependency-audit --security         # 只检查安全漏洞
/dependency-audit --licenses         # 只检查 license
/dependency-audit --fix              # 自动修复可安全升级的依赖

Common Mistakes

Dependency Audit

Scan project dependencies for security vulnerabilities, outdated packages, and license compliance issues.

Installation

# npx skills (recommended)
npx skills add wu529778790/shenzjd-skills -s dependency-audit -y

# Manual (Claude Code)
git clone https://github.com/wu529778790/shenzjd-skills.git
cp -r shenzjd-skills/dependency-audit ~/.claude/skills/

# Manual (Cursor)
# Copy SKILL.md content to .cursorrules or .cursor/rules/

Usage

/dependency-audit                    # Full audit
/dependency-audit --security         # Security vulnerabilities only
/dependency-audit --licenses         # License compliance only
/dependency-audit --fix              # Auto-fix safe upgrades

Audit Dimensions

Supported Ecosystems

Dependency Audit Report: {{project_name}}

Generated: {{date}}

Summary

Security Vulnerabilities

{{#each vulns}}

{{severity}}: {{name}}

• CVE: {{cve}}
• 描述: {{description}}
• 影响版本: {{affected_versions}}
• 修复版本: {{fixed_version}}
• 修复命令: {{fix_command}}

{{/each}}

{{#if no_vulns}} No known vulnerabilities found. {{/if}}

Outdated Dependencies

{{#each outdated}} | {{name}} | {{current}} | {{latest}} | {{upgrade_type}} | {{/each}}

License Compliance

{{#each licenses}} | {{name}} | {{count}} | {{risk}} | {{/each}}

{{#if gpl_licenses}}

⚠️ GPL/AGPL Dependencies

以下依赖使用 copyleft 许可证，可能影响项目license：

{{#each gpl_licenses}}

• {{name}}: {{license}}

{{/each}} {{/if}}

Recommended Actions

{{#each actions}} {{@index}}. {{description}} Command: {{command}}

{{/each}}