reviewing-dependencies
This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run an Aikido scan", or needs to evaluate dependency health, transitive risk, or supply chain security.
- Installs
- 88
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/bitwarden/ai-plugins --skill reviewing-dependencies- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads reviewing-dependencies automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Dependency Vulnerability Workflow
Step 1: Gather Alerts
# List all open Dependabot alerts sorted by severity
gh api /repos/{owner}/{repo}/dependabot/alerts --jq '.[] | select(.state == "open") | {number, severity: .security_vulnerability.severity, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, summary: .security_advisory.summary}'
# Filter by severity
gh api "/repos/{owner}/{repo}/dependabot/alerts?severity=critical&state=open"
# Get full details for a specific alert
gh api /repos/{owner}/{repo}/dependabot/alerts/{alert_number}
Step 2: Assess Impact
For each alert, determine:
- Is the vulnerable code path reachable? — Does the application actually use the vulnerable function/feature of the dependency?
- Is it a direct or transitive dependency? — Transitive vulnerabilities may be harder to fix but still pose real risk.
- What is the CVSS score and exploit availability? (Score with the CVSS convention
triaging-security-findingsdefines for effective severity.) A high CVSS with a public exploit needs immediate action. A medium CVSS with no known exploit can be scheduled. - What versions are affected and what versions fix it? — Check if updating is a minor bump or a breaking change.
Step 3: Decide on Action
| Situation | Action |
|---|---|
| Fix available, minor version bump | Update immediately |
| Fix available, major version bump | Evaluate breaking changes, schedule update |
| No fix available, code path reachable | Implement workaround or replace dependency |
| No fix available, code path not reachable | Document and monitor, set review date |
| Vulnerability in transitive dependency | Use overrides/resolutions to pin fixed version |
Transitive Dependency Risk
Direct dependencies are visible in package.json or .csproj files, but transitive dependencies (dependencies of dependencies) make up the majority of the dependency tree and are often invisible.
Why transitive dependencies matter:
- A vulnerability in a deeply nested dependency is just as exploitable as one in a direct dependency
- Transitive dependencies are less likely to be actively monitored
- Updating a transitive dependency may require updating the direct dependency that pulls it in
How to investigate:
# npm: Show full dependency tree
npm ls --all
# npm: Find which direct dependency pulls in a vulnerable transitive
npm ls <vulnerable-package>
# .NET: List all vulnerable packages including transitive
dotnet list package --vulnerable --include-transitive
# .NET: Show dependency graph
dotnet list package --include-transitive
Dependency Health Evaluation
When evaluating whether to adopt or keep a dependency, assess:
| Criterion | Green Flag | Red Flag |
|---|---|---|
| Maintenance | Regular commits, responsive to issues | No commits in 12+ months, unresponded issues |
| Vulnerability History | Few CVEs, quick patches | Repeated CVEs, slow response |
| Maintainer Count | Multiple active maintainers | Single maintainer, bus factor of 1 |
| Community | High download count, active users | Very low adoption for claimed scope |
| License | Compatible with project (MIT, Apache-2.0) | Restrictive or ambiguous license |
| Security Practices | Signed releases, security policy, 2FA | No security policy, no signed releases |
Aikido Integration
Aikido is Bitwarden's container and open-source dependency scanner. It continuously scans connected repositories, surfacing open-source (SCA) and container findings in the same feed as SAST, IaC, and secrets results.
Use the aikido:issues skill (aikido_issues_list) to query findings, scoping to the relevant repo and filtering issue_types to open_source (dependency CVEs) and docker_container (container image vulnerabilities). cloud_instance is a separate Aikido issue type for cloud VM/instance findings — out of scope for dependency and container review.
Use the caller-supplied Aikido evidence if you were given any. Otherwise query aikido:issues, and if it is unavailable, stop and tell the user rather than proceeding without this data.
# Use the aikido:issues skill, e.g.:
# issue_types: ["open_source"], repo_name: "<repo>" -> dependency CVEs
# issue_types: ["docker_container"], repo_name: "<repo>" -> container image vulnerabilities
Interpreting Aikido output:
- Each finding includes: issue title, type, severity (and severity label), remediation guidance, and SLA due date
- Use
out_of_sla: trueto focus on findings already past their remediation SLA - Triage follows the same Jira-based flow as other Aikido findings — see the
triaging-security-findingsskill
Platform-Specific Guidance
NuGet (.NET)
# Check for vulnerable packages
dotnet list package --vulnerable
# Include transitive dependencies
dotnet list package --vulnerable --include-transitive
# Check for outdated packages
dotnet list package --outdated
NuGet-specific concerns:
- .NET framework packages may have different vulnerability profiles than .NET Core
PackageReferencein.csprojis preferred overpackages.configfor better transitive resolution- Use
Directory.Packages.propsfor centralized version management in multi-project solutions
npm (Node.js)
# Run security audit
npm audit
# Auto-fix where possible
npm audit fix
# Force fixes (may introduce breaking changes)
npm audit fix --force
# Check lockfile integrity
npm ci # Installs exactly from lockfile, fails if lockfile is out of date
npm-specific concerns:
package-lock.jsonmust be committed and kept in sync- Use
overridesinpackage.jsonto force transitive dependency versions:{ "overrides": { "vulnerable-package": ">=2.0.0" } } - Beware of
postinstallscripts in dependencies — they execute arbitrary code duringnpm install
SBOM Concepts
A Software Bill of Materials (SBOM) is an inventory of all components in a software artifact. Understanding SBOMs helps reason about supply chain risk:
- What it contains: Package names, versions, licenses, relationships (direct vs. transitive)
- Why it matters: Enables rapid response when a new CVE is published — immediately identify which projects are affected
- Standard formats: SPDX, CycloneDX
- GitHub integration: GitHub generates dependency graphs automatically; Dependabot uses this for alerting
Critical Rules
- Never ignore critical/high Dependabot alerts without documented justification. Even if the vulnerable code path seems unreachable, document why.
- Prefer updating over pinning. Pinning a vulnerable version and adding a workaround accumulates tech debt. Update when a fix is available.
- Evaluate the full transitive tree. A direct dependency may be safe, but its transitive dependencies may not be.
- Review new dependencies before adoption. Check health criteria above before adding any new package. More dependencies = more attack surface.
- Lock dependencies. Always commit lockfiles (
package-lock.json,packages.lock.json). Usenpm ciin CI/CD, notnpm install.
FAQ
What does the reviewing-dependencies skill do?
This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run an Aikido scan", or needs to evaluate dependency health, transitive risk, or supply chain security.
How do I install reviewing-dependencies?
Run npx skills add https://github.com/bitwarden/ai-plugins --skill reviewing-dependencies in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/reviewing-dependencies/ (personal) or .claude/skills/reviewing-dependencies/ (project).
Which AI agents can use reviewing-dependencies?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is reviewing-dependencies safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains reviewing-dependencies?
It is published by bitwarden in bitwarden/ai-plugins, and it is an official skill from the maker of the technology it covers. It has 88 recorded installs.
More from bitwarden/ai-plugins
reviewing-security-architecture
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
threat-modeling
bitwarden/ai-plugins
This skill should be used when the user asks to "create a threat model", "define security goals", "generate a data flow diagram", "write security definitions", "perform an initial security assessment", or needs to produce threat model artifacts for new features or architecture changes.
retrospecting
bitwarden/ai-plugins
Performs comprehensive analysis of Claude Code sessions, examining git history, conversation logs, code changes, and gathering user feedback to generate actionable retrospective reports with insights for continuous improvement.
avoiding-false-positives
bitwarden/ai-plugins
Use this skill to validate findings during a code review. For each finding, run the rejection criteria and verification checks. If a finding fails any check, drop it. In PR mode it also holds the once-per-review stacked-PR gate that decides whether completeness findings apply to the pull request at all.
reviewing-claude-config
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
posting-review-summary
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.