Claude Cursor Skill

dependency-awareness

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable, mix_audit). Load when adding, updating, or auditing project dependencies, wiring up CI s

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download goldziher-ai-rulez-internal_builtins_universal_security_skills_dependency-awareness-ca967ad.zip · 0 KB

goldziher/ai-rulez 162 16 forks MIT Updated 5h ago

Part of goldziher/ai-rulez — 151 skills

Install

skills CLI

npx skills add https://github.com/Goldziher/ai-rulez/tree/main/internal/builtins/universal/security/skills/dependency-awareness

Claude Code claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install goldziher-ai-rulez@llmmart

Git git clone https://github.com/Goldziher/ai-rulez.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole goldziher/ai-rulez collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Audit dependencies before adding them. Prefer well-maintained, widely-used packages with active maintenance. Pin versions and commit lock files. Use language-specific audit tools in CI:

Rust: cargo audit, cargo deny (license + advisory policies)
Python: pip-audit, bandit (SAST)
JavaScript/TypeScript: npm audit, pnpm audit
Go: govulncheck
Ruby: bundler-audit
PHP: composer audit
Java: OWASP dependency-check Maven/Gradle plugin
C#: dotnet list package --vulnerable
Elixir: mix_audit Zero tolerance for critical/high CVEs. Automate dependency update PRs where possible.

Files (ai-rulez)

SKILL.md 997 B

---
name: dependency-awareness
description: Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable, mix_audit). Load when adding, updating, or auditing project dependencies, wiring up CI supply-chain checks, or triaging CVEs in a lock file.
---

Audit dependencies before adding them. Prefer well-maintained, widely-used packages with active maintenance. Pin versions and commit lock files. Use language-specific audit tools in CI:

- Rust: `cargo audit`, `cargo deny` (license + advisory policies)
- Python: `pip-audit`, `bandit` (SAST)
- JavaScript/TypeScript: `npm audit`, `pnpm audit`
- Go: `govulncheck`
- Ruby: `bundler-audit`
- PHP: `composer audit`
- Java: OWASP `dependency-check` Maven/Gradle plugin
- C#: `dotnet list package --vulnerable`
- Elixir: `mix_audit`
  Zero tolerance for critical/high CVEs. Automate dependency update PRs where possible.