Dependency Analysis Skill

Purpose

Systematic analysis of project dependencies for security and maintenance.

When to Use

• Security audits
• Before adding new dependencies
• Planning version upgrades
• Regular maintenance checks

Analysis Process

Step 1: Identify Package Manager

Detect from files:

• package-lock.json

  /

  yarn.lock

  /

  pnpm-lock.yaml

  → Node.js

• requirements.txt

  /

  Pipfile.lock

  /

  poetry.lock

  → Python

• go.sum

  → Go

Step 2: Run Security Audit

Execute appropriate command:

# Node.js
npm audit --json || yarn audit --json

# Python (if pip-audit installed)
pip-audit --format json

# Go
govulncheck ./...

Step 3: Check Outdated

# Node.js
npm outdated --json

# Python
pip list --outdated --format json

# Go
go list -u -m all

Step 4: Analyze Results

Categorize findings:

• Critical: Security vulnerabilities with known exploits
• High: Security issues or major version behind
• Medium: Minor version behind or deprecated
• Low: Patch version behind

Output Format

Use templates/dep-report.md

Storage Location

Save to:

docs/research/dependency-audit-{date}.md