--- name: dependency-risk-audit-f5fb11104438 description: Review Python dependencies for known security advisories, stale version pins, and unsafe upgrade paths. Use when users ask for dependency security reviews, requirements or lockfile audits, upgrade planning, pre-release risk checks, or remediation prioritization for Python projects. --- # Dependency Risk Audit Run a repeatable dependency-risk audit for Python projects and return a prioritized remediation plan. ## Workflow ### Step 1: Identify dependency source of truth 1. Detect package manager and files in this order: - `poetry.lock` + `pyproject.toml` - `uv.lock` + `pyproject.toml` - `Pipfile.lock` + `Pipfile` - `requirements*.txt` and optional `constraints*.txt` 2. Prefer lockfiles for resolved versions. 3. Record Python runtime constraint from: - `pyproject.toml` (`requires-python`) - `.python-version` - CI config (if present) ### Step 2: Build dependency inventory Create an inventory with: - package name - installed/resolved version - dependency type (`direct` or `transitive`) - pin style (`exact`, `range`, `unbounded`) - marker constraints (Python version, platform markers) If direct/transitive split is unavailable from project files, state that limitation explicitly. ### Step 3: Run security advisory checks Prefer `pip-audit`. If unavailable, fall back to lockfile/static analysis and mark advisories as partially evaluated. Common commands: ```bash # requirements.txt projects pip-audit -r requirements.txt -f json # active environment pip-audit -f json ``` For non-requirements workflows, export to requirements format first when possible, then audit that export. For each finding, capture: - advisory ID (for example `PYSEC-*`, `CVE-*`, `GHSA-*`) - package + affected version - fixed version range - severity (if available) - exploit or impact notes (if available) ### Step 4: Detect stale pins Classify each direct dependency: - `current`: no newer release in same major - `minor/patch stale`: behind within same major - `major stale`: newer major available - `unknown`: latest data unavailable Flag stale pins as higher risk when: - package is internet-facing, auth-related, crypto-related, or framework/core runtime - current version is multiple majors behind - package has a recent advisory history ### Step 5: Evaluate upgrade-path safety For each dependency requiring change, assess upgrade risk: - `low`: patch/minor upgrade, no known breaking changes - `medium`: minor upgrade with behavior/config changes - `high`: major upgrade, Python-version jump, or resolver conflicts likely Check these risk signals: - major-version jump required to reach fixed secure version - declared Python requirement of target version conflicts with project runtime - conflicting upper bounds across dependencies - framework-coupled libraries that typically require code migrations When possible, propose a stepwise path: 1. patch/minor upgrades first 2. isolated major upgrades next 3. framework/runtime upgrades last ### Step 6: Produce the report Return a markdown report using this structure: ```markdown ## Dependency Risk Audit Audit root: `` Dependency source: `` Python runtime target: `` ### Executive Summary - Overall risk: [LOW|MEDIUM|HIGH|CRITICAL] - Known advisories: X (Critical Y, High Z, ...) - Stale direct dependencies: X (Major-stale Y) - Unsafe upgrade paths: X ### Security Advisories | Package | Version | Advisory | Severity | Fixed In | Notes | | ------- | ------- | -------- | -------- | -------- | ----- | ### Stale Pins | Package | Current | Latest | Drift Type | Risk Notes | | ------- | ------- | ------ | ---------- | ---------- | ### Upgrade Path Risks | Package | Current -> Target | Risk | Why Risky | Recommended Path | | ------- | ----------------- | ---- | --------- | ---------------- | ### Prioritized Remediation Plan 1. ... 2. ... 3. ... ### Not Evaluated - Item + reason ``` ## Scoring Guidance (optional) If the user asks for a numeric score, start at `100` and deduct: - Critical advisory: `-15` - High advisory: `-10` - Medium advisory: `-6` - Low advisory: `-3` - Major-stale direct dependency: `-4` - High-risk upgrade path: `-5` Floor at `0`. Cap repeated deductions for the same package/advisory pair. ## Remediation Loop If the user asks for fixes: 1. Address critical/high advisories first, prioritizing low-risk upgrades. 2. Re-run audit steps 2-6. 3. Report risk delta, unresolved blockers, and required code changes/tests. --- Source attribution: ragnarok22 Original project: https://github.com/ragnarok22/agent-skills/blob/a7a679d509a3a36a9c174aedbe4a459403a729a0/skills/dependency-risk-audit/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Reinier Hernández Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: ragnarok22 Original project: https://github.com/ragnarok22/agent-skills/blob/a7a679d509a3a36a9c174aedbe4a459403a729a0/skills/dependency-risk-audit/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering Roles: Backend Developer, Data Analyst, ML / AI Engineer Specialties: API, Backend Tools: Pip Audit Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 46fbeae15b6e998eb569dc50b57dfe0036219d9f60d1c2bf3464b3575da60bd4