Audits Python dependencies for security vulnerabilities and updates using pip tools.
Install
mkdir -p .claude/skills/dependency-audit && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/19168" && unzip -o skill.zip -d .claude/skills/dependency-audit && rm skill.zipInstalls to .claude/skills/dependency-audit
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Audit Python dependencies for vulnerabilities, outdatedKey capabilities
- →Install Python audit tooling
- →Scan for known vulnerabilities in requirements.txt
- →Check for outdated packages among direct dependencies
- →Check dependency tree for conflicts
- →Flag sensitive packages for manual review
- →Apply patch-level updates for security vulnerabilities
How it works
The skill installs auditing tools, then systematically scans for vulnerabilities, checks for outdated packages, analyzes dependency conflicts, and flags sensitive packages before applying safe fixes.
Inputs & outputs
When to use dependency-audit
- →Find security vulnerabilities
- →Audit outdated packages
- →Resolve dependency conflicts
About this skill
Python Dependency Audit
Step 1 — Install audit tooling
pip install pip-audit pipdeptree
Step 2 — Scan for known vulnerabilities
pip-audit -r requirements.txt
Flag any findings by severity. Critical and high findings require a fix PR. Moderate and low go in the report only.
Step 3 — Check for outdated packages
pip list --outdated --format=json
Cross-reference against requirements.txt to report only
direct dependencies, not transitive ones.
Step 4 — Check dependency tree for conflicts
pipdeptree --warn fail
Step 5 — Flag sensitive packages
shapely, pyproj, and fiona have C library bindings.
Major version bumps on these must be flagged for manual
review — do not auto-update.
Step 6 — Apply safe fixes
Patch-level updates for security vulnerabilities can be
applied directly. Pin to exact versions in requirements.txt
(e.g. requests==2.32.3).
Run pytest after any change to verify nothing breaks.
Step 7 — Produce report
Summarize:
- Critical/High vulnerabilities (with fix status)
- Available updates (major/minor/patch)
- Any dependency conflicts
- PRs created
When not to use it
- →When auditing non-Python dependencies
- →When automatic major version updates are desired for sensitive packages
- →When a full system-wide dependency audit is needed beyond Python
Limitations
- →Only Python dependencies are audited
- →Major version bumps on shapely, pyproj, and fiona require manual review
- →pytest must be run after any change to verify nothing breaks
How it compares
This skill provides a structured, step-by-step process for auditing Python dependencies, including specific tools and actions for different types of issues, unlike a general security scan.
Compared to similar skills
dependency-audit side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| dependency-audit (this skill) | 0 | 3mo | Review | Intermediate |
| senior-security | 31 | 7mo | Review | Advanced |
| dependency-auditor | 1 | 9mo | Review | Beginner |
| codebase-cleanup-deps-audit | 2 | 3mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
codebase-cleanup-deps-audit
sickn33
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
security-audit
hiroshiyui
Perform a project-wide security and safety audit of the 5thPlanet workspace.
qa-security
christopherlouet
Perform a security audit based on OWASP. Use when the user wants to verify security, look for vulnerabilities, or before a production deployment.
contrib-pr-review
homeassistant-ai
Review a contribution PR for safety, quality, and readiness. Checks for security concerns, test coverage, size appropriateness, and intent alignment. Use when reviewing external contributions.