Dependency Auditor

by laolaoshiren

Dependency Auditor is a Quality skill for Claude Code, published by laolaoshiren in claude-code-skills-zh.

786 stars84 forkson laolaoshiren/claude-code-skills-zhAdded 2026/08/23+1% in starsRepository updated 2026/08/23

View source on GitHub Download repo ZIP

ai-agentawesome-listclaude-codeclaude-skillsdeveloper-toolsprompt-engineeringskills

Install in seconds

Install Dependency Auditor

Copy Dependency Auditor into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/dep-auditor ~/.claude/skills/dep-auditor

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/laolaoshiren/claude-code-skills-zh.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/dep-auditor/SKILL.md in laolaoshiren/claude-code-skills-zh
Installs to: ~/.claude/skills/dep-auditor
Collection: One of 20 skills cataloged from this repository
Category: Quality — 1354 skills

What Dependency Auditor does

Dependency Auditor 审计 Node.js、Python、Go、Rust、JVM 和 Ruby 项目的依赖漏洞、版本健康度与许可证事实。适合在检查 lockfile、manifest 或生成不改依赖的中文审计报告时使用。

Dependency Auditor is cataloged under Quality on DirSkills. Dependency Auditor comes from a repository tagged ai-agent, awesome-list, claude-code, claude-skills and developer-tools.

Documentation

README

Excerpt

依赖安全审计

核心原则

默认只读。用户只要求“检查、审计、报告”时，不修改 manifest、lockfile、源码、CI 或外部服务。
以实际解析版本和可追溯 advisory 为证据。不要凭包名、版本年龄或记忆猜测 CVE、修复版本、可达性与许可证。
优先使用项目锁定的包管理器和已有审计命令。不要为完成审计而裸跑 npx，也不要擅自执行 pip install、go install、cargo install 等下载命令。
把“发现问题”“建议修复”“执行修改”分开。任何会改依赖或 lockfile 的动作都需要用户明确授权。
许可证部分只陈述事实、适用场景和待确认事项，不作法律结论。

工作流程

1. 确认范围与授权

确认目标目录、生态、工作区范围和生产 / 开发依赖是否都要检查。
说明将运行的命令、是否访问网络、可能向 registry 或漏洞服务发送哪些包元数据。
先检查工作树和现有改动。不要覆盖、回退或混入用户未提交的修改。
若缺少锁文件、工具或网络，继续完成可验证部分，并把覆盖缺口写入报告；不要用推测填空。

2. 建立依赖清单

This is the opening of the README. Read the full README on GitHub.

Frequently asked about Dependency Auditor

What else does laolaoshiren publish alongside Dependency Auditor?
Dependency Auditor is one of 20 skills that DirSkills catalogs from laolaoshiren/claude-code-skills-zh, the repository it ships in. Its siblings there include API Tester, Changelog Generator and Chinese Code Reviewer. Each one is a separate skill with its own page in this directory, installs the same way Dependency Auditor does, and is maintained by laolaoshiren in that same repository. The rest of the collection is listed on the laolaoshiren/claude-code-skills-zh page.
How does Dependency Auditor compare to other Quality skills?
Dependency Auditor ranks #983 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Dependency Auditor against them. Open each page to compare what they document and how they install.