Audit project libraries for known security vulnerabilities, outdated versions, and license issues across several package ecosystems. Trace problems through indirect dependencies and produce prioritized findings, upgrade commands, and alternatives for packages that are no longer maintained.
中文简介正在准备中。当前显示英语简介。
Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
Analyze project dependencies for known security vulnerabilities, outdated versions, and license compliance issues across multiple package ecosystems. This skill inspects npm, pip, Composer, Gem, Go module, and Cargo manifests and lock files, cross-references findings against CVE databases, and produces actionable remediation guidance with upgrade paths.
${CLAUDE_SKILL_DIR}/npm, pip/pip-audit, composer, gem, go, or cargoreferences/README.md for npm/pip audit report formats, license compatibility matrix, and dependency management best practices${CLAUDE_SKILL_DIR}/ for manifest files: package.json and package-lock.json (npm/Node.js), requirements.txt/pyproject.toml/Pipfile.lock (Python), composer.json/composer.lock (PHP), Gemfile/Gemfile.lock (Ruby), go.mod/go.sum (Go), Cargo.toml/Cargo.lock (Rust).npm audit --json and parse the structured output. Map each advisory to its CVE identifier, CVSS score, severity level, vulnerable version range, and patched version.pip-audit --format=json or parse safety check --json output. Cross-reference each vulnerability against the OSV database for additional context.composer audit, bundle audit, cargo audit, govulncheck) and normalize the output to a common finding format.references/README.md.npm install package@version, pip install --upgrade package==version) prioritized by severity| Error | Cause | Solution |
|---|---|---|
npm audit returns exit code 1 | Vulnerabilities found (expected behavior) | Parse the JSON output normally; exit code 1 indicates findings, not a tool failure |
pip-audit not installed | Tool not available in the environment | Install with pip install pip-audit or fall back to manual pip list --outdated combined with OSV API queries |
| Lock file missing or outdated | Dependencies not properly locked | Run npm install, pip freeze, or equivalent to generate/update the lock file before scanning |
| Network timeout querying vulnerability DB | Firewall or connectivity issue | Retry with increased timeout; fall back to offline analysis of lock file versions against cached CVE data |
| Mixed ecosystem project | Multiple manifest files in one repo | Scan each ecosystem independently and combine results into a unified report |
| Private registry packages not found | Audit tools cannot resolve private packages | Skip private packages in the vulnerability scan; note them as "unverifiable" in the report |
Run npm audit --json in ${CLAUDE_SKILL_DIR}/. Parse the output to identify critical
and high severity advisories. For each, trace the dependency chain from direct
dependency to vulnerable package. Produce upgrade commands:
npm install express@4.19.2 to resolve CVE-2024-XXXXX in path-to-regexp.
Flag any advisory without a fix available as requiring a workaround or alternative package.
Run pip-audit --format=json -r ${CLAUDE_SKILL_DIR}/requirements.txt. Map each
vulnerability to its CVE, CVSS score, and fixed version. For transitive
dependencies, identify the direct dependency pulling in the vulnerable package.
Recommend pinning to safe versions in requirements.txt and adding
pip-audit to the CI pipeline.
Extract licenses from ${CLAUDE_SKILL_DIR}/node_modules/ using license-checker --json
or equivalent. Flag any GPL-3.0 or AGPL-3.0 licensed package used in a
proprietary application as a license conflict. Flag packages with UNLICENSED
or missing license fields as requiring legal review before production use.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Add a synthetic-data CI gate for customer-owned Abridge integration code. Test consent handling, note-review handoffs, redaction, and rollback behavior with mocked vendor boundaries, without connecting CI to a live Abridge or EHR tenant.
中文简介正在准备中。当前显示英语简介。
Triage Abridge recording, note review, Epic handoff, and access problems using observed symptoms and approved guidance. Identify the affected workflow stage, organize a minimal timeline, and prepare a redacted escalation record for the responsible team.
中文简介正在准备中。当前显示英语简介。
Map and review an Abridge clinical documentation workflow from consent and recording through draft review, evidence checks, edits, and final disposition. Keep clinician approval explicit, identify failure exits, and separate verified facts from tenant-specific details and pending approvals.
中文简介正在准备中。当前显示英语简介。
Audit how clinician-reviewed Abridge note sections map into Epic templates and downstream workflows. Use approved test records to document destinations, exceptions, evidence, rollback steps, and a go or no-go decision for a specific environment.
中文简介正在准备中。当前显示英语简介。
Review Abridge adoption and workflow value using local usage records, clinician feedback, and verified contract costs. Build an evidence based decision table covering adoption, quality, support burden, and options to expand, hold, or improve the rollout.
中文简介正在准备中。当前显示英语简介。
Prepare a bounded support bundle for an Abridge issue using allowlisted operational details such as versions, coarse timestamps, and correlation references. Exclude recordings, transcripts, patient identifiers, credentials, and unrestricted logs, then document redactions and review details.
中文简介正在准备中。当前显示英语简介。