Dependency Auditor

/plugin marketplace add alirezarezvani/claude-skills sonra /plugin install engineering-advanced-skills@claude-code-skills

Three scripts parse the manifests and lockfiles of npm, pip, Go, Cargo, Bundler, Maven, Composer and NuGet projects and produce machine-readable output: what looks vulnerable, which licences clash with the project's own, and an upgrade sequence ordered by risk with rollback notes. The documentation is honest about the limit — the matching is offline and pattern-based, so it is meant to sit next to npm audit or pip-audit rather than replace them. After the upgrades land the scan is repeated and has to come back clean.