npx claudepluginhub mathews-tom/armory --plugin armoryThis skill uses the workspace's default tool permissions.
Comprehensive dependency risk assessment: license compatibility analysis, maintenance
Implements Playwright E2E testing patterns: Page Object Model, test organization, configuration, reporters, artifacts, and CI/CD integration for stable suites.
Guides Next.js 16+ Turbopack for faster dev via incremental bundling, FS caching, and HMR; covers webpack comparison, bundle analysis, and production builds.
Discovers and evaluates Laravel packages via LaraPlugins.io MCP. Searches by keyword/feature, filters by health score, Laravel/PHP compatibility; fetches details, metrics, and version history.
Comprehensive dependency risk assessment: license compatibility analysis, maintenance health scoring, CVE detection, bloat identification, and transitive dependency risk mapping. Produces an actionable report with prioritized remediation steps organized by urgency (security → license → maintenance → bloat).
| File | Contents | Load When |
|---|---|---|
references/license-compatibility.md | License compatibility matrix, copyleft detection, commercial-safe licenses | Always |
references/health-metrics.md | Maintenance health indicators, scoring criteria, abandonment detection | Always |
references/bloat-detection.md | Identifying unused deps, duplicate functionality, heavy transitive trees | Bloat analysis requested |
references/cve-sources.md | CVE databases, advisory sources, vulnerability severity interpretation | Security audit requested |
pyproject.toml, requirements.txt,
package.json, Cargo.toml, go.mod)==1.2.3), ranged (>=1.0,<2.0), or floating (*).Tools:
uv pip list, pip-audit, pipdeptreenpm list --all, npm auditcargo tree, cargo auditFor each dependency:
Identify the license — Check package metadata, LICENSE file, pyproject.toml.
Classify compatibility — Against the project's own license:
| License | Commercial OK | Copyleft | Risk Level |
|---|---|---|---|
| MIT, BSD, ISC, Apache 2.0 | Yes | No | Low |
| LGPL | With care | Weak | Medium |
| GPL-2.0, GPL-3.0 | No (unless GPL project) | Strong | High |
| AGPL | No (unless AGPL project) | Strong + network | Critical |
| Unknown | Cannot determine | Unknown | Critical |
Flag issues — Copyleft licenses in proprietary projects, unknown licenses, license changes between versions.
For each dependency, evaluate maintenance signals:
| Indicator | Healthy | Warning | Abandoned |
|---|---|---|---|
| Last release | < 6 months | 6-18 months | > 18 months |
| Commits (90 days) | 10+ | 1-9 | 0 |
| Open issues response | < 2 weeks | 2-8 weeks | > 8 weeks or no response |
| Bus factor | 3+ maintainers | 2 | 1 |
| CI status | Passing | Flaky | Failing or absent |
Known CVEs — Check against advisory databases:
pip-audit, PyPI advisory databasenpm audit, GitHub Advisory DatabaseSeverity classification — CVSS score interpretation:
| CVSS Score | Severity | Action |
|---|---|---|
| 9.0-10.0 | Critical | Upgrade immediately |
| 7.0-8.9 | High | Upgrade within days |
| 4.0-6.9 | Medium | Upgrade within weeks |
| 0.1-3.9 | Low | Upgrade at convenience |
Fix availability — Is there a patched version? If not, what's the workaround?
Produce a prioritized report with action items.
## Dependency Audit: {Project Name}
### Summary
| Metric | Count |
|--------|-------|
| Direct dependencies | {N} |
| Transitive dependencies | {N} |
| License issues | {N} |
| Maintenance concerns | {N} |
| Security vulnerabilities | {N} |
| Bloat candidates | {N} |
### License Compliance
| Package | Version | License | Compatible | Issue |
|---------|---------|---------|------------|-------|
| {pkg} | {ver} | MIT | Yes | None |
| {pkg} | {ver} | GPL-3.0 | No | Copyleft in proprietary project |
| {pkg} | {ver} | Unknown | Unknown | License not identifiable |
### Maintenance Health
| Package | Last Release | Commits (90d) | Maintainers | Status |
|---------|-------------|---------------|-------------|--------|
| {pkg} | {date} | {N} | {N} | {Healthy/Warning/Abandoned} |
### Security Vulnerabilities
| Package | Version | CVE | Severity | Fix Available | Fixed In |
|---------|---------|-----|----------|---------------|----------|
| {pkg} | {ver} | {CVE-ID} | {severity} | {Yes/No} | {version} |
### Bloat Analysis
| Package | Install Size | Used By | Recommendation |
|---------|-------------|---------|----------------|
| {pkg} | {size} | {usage description} | {Remove/Replace/Keep} |
### Action Items
#### Immediate (Security)
1. Upgrade {pkg} to {version} — fixes {CVE-ID} ({severity})
#### Short-term (License)
1. Review {pkg} GPL usage — may require license change or removal
#### Medium-term (Maintenance)
1. Find alternative to {pkg} — abandoned since {date}
#### Long-term (Bloat)
1. Remove {pkg} — unused in codebase
2. Replace {pkg} with lighter alternative
### Transitive Risk
- {direct-dep} depends on {transitive-dep} which has {issue}
| Problem | Resolution |
|---|---|
| No lock file available | Audit based on declared dependencies. Note that transitive analysis is incomplete without a lock file. |
| License metadata missing | Check the package's repository for LICENSE file. Note packages where license cannot be determined. |
| Package registry unavailable | Work from cached metadata and local lockfile data. |
| Too many dependencies to audit manually | Prioritize: production deps first, then direct deps, then transitive deps with known issues. |
Push back if:
| Rationalization | Reality |
|---|---|
| "It's a trusted package" | Trust is not a security model — trusted packages get compromised (event-stream, ua-parser-js, colors.js) |
| "Only a minor version bump" | Minor versions can introduce vulnerabilities, change behavior, or add transitive dependencies — semver is a promise, not a guarantee |
| "We don't use the vulnerable function" | Transitive dependencies might — and attack surface includes any code loaded into the process |
| "The CVE is low severity" | Low severity in isolation can be critical in your context — a "low" SSRF in an internal service with cloud metadata access is critical |
| "We'll update when there's a known exploit" | Known exploits mean you're already behind — patch within SLA, not after breach |
| "Too many dependencies to audit" | That's the problem, not an excuse — high dependency count IS a risk finding |
npm audit / pip-audit / cargo audit