dependency-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Dependency Audit

## Evaluating New Dependencies

Before adding any dependency, run through this evaluation checklist. Every "no" answer is a risk that must be explicitly accepted.

### Evaluation Checklist

- [ ] **Maintenance**: Last commit within 6 months? Issues responded to? More than one maintainer?
- [ ] **Adoption**: More than 1,000 weekly downloads (npm) or equivalent? Used by known projects?
- [ ] **Bundle size**: Checked via bundlephobia.com or equivalent? Is tree-shaking supported?
- [ ] **License**: Compatible with your project license? (See license matrix below)
- [ ] **Security**: No open CVEs? Has a security policy? Publishes signed releases?
- [ ] **API surface**: Does it do one thing well, or is it a kitchen-sink package?
- [ ] **Alternatives**: Have you checked if the standard library or an existing dep covers this?
- [ ] **Transitive deps**: How many transitive dependencies does it pull in?

### Quick Evaluation Commands

```bash
# npm — check package info
npm info <package> --json | jq '{name, version, license, homepage, maintainers}'

# Check download stats
npm info <package> --json | jq '.downloads'

# Bundle size (requires bundlephobia API or website)
# Visit: https://bundlephobia.com/package/<package>

# Check for known vulnerabilities before installing
npm audit --dry-run --package-lock-only

# Python — check package metadata
pip show <package>
pip index versions <package>

# Rust — check crate info
cargo info <crate>
```

### Decision Framework

| Factor               | Accept                       | Investigate                    | Reject                        |
|----------------------|------------------------------|--------------------------------|-------------------------------|
| Weekly downloads     | > 50,000                     | 1,000 - 50,000                 | < 1,000                       |
| Last commit          | < 3 months                   | 3 - 12 months                  | > 12 months                   |
| Open issues          | < 50 with triage             | 50 - 200                       | > 200 untriaged               |
| Maintainers          | >= 2                         | 1 active                       | 0 active                      |
| Transitive deps      | < 5                          | 5 - 20                         | > 20                          |
| Bundle size (JS)     | < 10 KB gzipped              | 10 - 50 KB                     | > 50 KB (for a single feature)|
| License              | MIT, Apache-2.0, BSD         | ISC, MPL-2.0                   | GPL, AGPL, SSPL, unlicensed   |

---

## Security Vulnerability Scanning

### npm / Yarn

```bash
# Run audit against known vulnerability databases
npm audit

# Fix automatically where possible
npm audit fix

# Fix with major version bumps (review changes carefully)
npm audit fix --force

# Generate machine-readable report
npm audit --json > audit-report.json

# Yarn equivalent
yarn audit
yarn audit --json
```

### pip (Python)

```bash
# Install safety or pip-audit
pip install pip-audit

# Run audit
pip-audit

# Output in JSON
pip-audit --format json --output audit-report.json

# Check a requirements file without installing
pip-audit -r requirements.txt
```

### Cargo (Rust)

```bash
# Install cargo-audit
cargo install cargo-audit

# Run audit
cargo audit

# Fix where possible
cargo audit fix

# Generate JSON report
cargo audit --json
```

### Go

```bash
# Built-in vulnerability scanning (Go 1.18+)
govulncheck ./...
```

### CI Integration

Run audits on every pull request. Fail the build on critical or high severity findings.

From Claude-Code-Community-Ireland/claude-code-resources, MIT.

More from Claude-Code-Community-Ireland/claude-code-resources