Skill: Dependency Audit

Purpose

Audit third-party dependencies for known vulnerabilities, outdated versions, license compliance, and supply chain risks.

When to Use

• Before releases
• After dependency updates
• Security incident response
• Periodic security reviews
• New dependency evaluation
• Supply chain security assessment

---

Audit Categories

Vulnerability Analysis

Source	Coverage	Update Frequency
NVD (CVE)	All languages	Daily
GitHub Advisory	All languages	Real-time
npm Audit	JavaScript/Node	Real-time
Snyk	Multi-language	Real-time
OSV	Open Source	Real-time

Severity Classification

Level	CVSS Score	Response Time
Critical	9.0 - 10.0	Immediate (< 24h)
High	7.0 - 8.9	Urgent (< 1 week)
Medium	4.0 - 6.9	Planned (< 1 month)
Low	0.1 - 3.9	Backlog

---

Dependency Analysis

Direct Dependencies

## Direct Dependency Analysis

### Summary
| Metric | Count |
|--------|-------|
| Total Dependencies | {{total}} |
| With Vulnerabilities | {{vulnerable}} |
| Outdated (Major) | {{major_outdated}} |
| Outdated (Minor) | {{minor_outdated}} |
| Deprecated | {{deprecated}} |

### Vulnerable Packages

| Package | Current | Vuln Count | Highest Severity |
|---------|---------|------------|------------------|
| lodash | 4.17.20 | 2 | High |
| axios | 0.21.0 | 1 | Medium |

Transitive Dependencies

## Transitive Dependency Analysis

### Dependency Tree Depth
- Maximum depth: {{max_depth}}
- Total packages: {{total_packages}}
- Unique packages: {{unique_packages}}

### Vulnerable Transitives

| Package | Version | Introduced By | Severity |
|---------|---------|---------------|----------|
| minimist | 1.2.0 | mocha > yargs | High |
| glob-parent | 5.1.0 | jest > glob | Medium |

---

Vulnerability Report Template

## Dependency Vulnerability Report

**Scan Date:** {{date}}
**Project:** {{project}}
**Package Manager:** {{package_manager}}
**Lock File:** {{lock_file}}

### Executive Summary

| Severity | Count | Action Required |
|----------|-------|-----------------|
| Critical | {{critical}} | Immediate upgrade |
| High | {{high}} | Upgrade this sprint |
| Medium | {{medium}} | Plan upgrade |
| Low | {{low}} | Monitor |

**Total Vulnerabilities:** {{total}}
**Packages Affected:** {{affected_packages}}

---

### Critical Vulnerabilities

#### CVE-2021-44228 - Log4Shell
**Package:** log4j-core
**Current Version:** 2.14.1
**Fixed Version:** 2.17.0
**CVSS:** 10.0 (Critical)

**Description:**
Apache Log4j2 JNDI features do not protect against attacker-controlled LDAP and other JNDI-related endpoints.

**Attack Vector:**
Remote code execution via crafted log message.

**Affected Code Paths:**

• com.example.app.logging
• com.example.app.api.RequestLogger

**Remediation:**
```xml
<!-- Update pom.xml -->
<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.17.0</version>
</dependency>

Workaround (if upgrade not possible): Set system property: -Dlog4j2.formatMsgNoLookups=true

References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://logging.apache.org/log4j/2.x/security.html

---

High Vulnerabilities

...

Upgrade Path

Package	Current	Target	Breaking Changes
log4j	2.14.1	2.17.0	None
axios	0.21.0	1.6.0	Major version (see notes)

Breaking Change Notes

axios 0.21.0 → 1.6.0

• Response type changes
• FormData handling updated
• See migration guide: https://axios-http.com/docs/migration

---

## License Compliance

### License Analysis

```markdown
## License Compliance Report

### License Distribution

| License | Count | Risk |
|---------|-------|------|
| MIT | 145 | Low |
| Apache-2.0 | 52 | Low |
| BSD-3-Clause | 23 | Low |
| ISC | 18 | Low |
| GPL-3.0 | 2 | High (copyleft) |
| Unknown | 3 | Review required |

### Compliance Issues

#### High Risk: GPL-3.0 Licensed Package
**Package:** some-gpl-package
**License:** GPL-3.0
**Risk:** Copyleft license may require source disclosure

**Options:**
1. Remove package and find alternative
2. Obtain commercial license
3. Isolate in separate service
4. Ensure compliance with GPL terms

#### Unknown License
**Package:** mystery-package
**Risk:** Cannot verify usage rights

**Action Required:**
- Contact maintainer for clarification
- Review source repository for license file
- Consider alternative package

---

Supply Chain Security

Maintainer Analysis

## Supply Chain Risk Assessment

### Maintainer Status

| Package | Maintainers | Last Update | Status |
|---------|-------------|-------------|--------|
| critical-pkg | 1 | 2 years ago | HIGH RISK |
| another-pkg | 5 | 1 week ago | Low risk |
| old-package | 0 | 4 years ago | ABANDONED |

### High-Risk Indicators
- Single maintainer (bus factor = 1)
- No recent updates (> 1 year)
- No security policy
- No 2FA enforcement
- Recent ownership transfer

### Recommendations
1. **critical-pkg:** Find alternative or fork
2. **old-package:** Migrate to maintained fork

Typosquatting Check

## Typosquatting Analysis

### Suspicious Package Names
Checking for known typosquatting patterns...

| Installed | Similar To | Status |
|-----------|------------|--------|
| lodash | lodash | ✓ Verified |
| expresss | express | ⚠️ Potential typosquat |

**Action:** Review `expresss` package - may be typosquatting `express`

---

Remediation Workflow

Automated Updates

# Dependabot configuration
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "security"

Manual Update Process

## Update Procedure

1. **Review vulnerability details**
   - Understand the risk
   - Check if code path is affected

2. **Check upgrade path**
   - Review changelog
   - Identify breaking changes
   - Test in development

3. **Apply update**
   ```bash
   npm update package-name
   # or for major version
   npm install package-name@latest

4. Verify fix

   • Re-run audit
   • Run test suite
   • Test affected features

5. Document

   • Update changelog
   • Note any workarounds applied

---

## Agents Using This Skill

- **DevOps Engineer** - CI/CD integration, automation
- **Senior Developer** - Update evaluation, implementation
- **Software Architect** - Dependency strategy

## Related Skills

- `security-vulnerability-scan` - Code vulnerabilities
- `security-compliance-check` - Component compliance
- `github-pr-management` - Update PRs

## MCP Tools Used

- `Atlassian:createJiraIssue` - Vulnerability tracking
- `Atlassian:addCommentToJiraIssue` - Update documentation