Skill: phy041/phy-dep-upgrade (version 1.0.3)

--- name: Dep Upgrade description: Dependency audit and upgrade planner for Node.js, Python, Rust, Go, and Ruby projects. Scans for outdated packages, vulnerability CVEs, and breaking changes, then produces a prioritized upgrade plan with exact commands. Zero external API required — works entirely from your project files and standard package manager CLIs. Triggers on "audit dependencies", "check for vulnerabilities", "upgrade packages", "outdated deps", "/dep-upgrade". license: Apache-2.0 homepage: https://canlah.ai metadata: author: Canlah AI version: "1.0.3" tags: - dependencies - security - npm - pip - cargo - go - audit - upgrade - maintenance --- # Dependency Audit & Upgrade Planner Scan any project for outdated and vulnerable dependencies across Node.js, Python, Rust, Go, and Ruby — then produce a prioritized, actionable upgrade plan with exact commands and breaking-change warnings. **No API keys. No external services. Works entirely from your project files and standard CLIs.** --- ## Trigger Phrases - "audit dependencies", "check deps", "check for vulnerabilities" - "upgrade packages", "update dependencies", "outdated packages" - "npm audit", "pip audit", "security vulnerabilities in deps" - "/dep-upgrade" --- ## Step 1: Detect Project Type Scan the current directory for lockfiles and manifests to identify all project types present: ```bash # Detect all project types in one pass ls package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null && echo "NODE" ls requirements.txt pyproject.toml setup.py Pipfile 2>/dev/null && echo "PYTHON" ls Cargo.toml Cargo.lock 2>/dev/null && echo "RUST" ls go.mod go.sum 2>/dev/null && echo "GO" ls Gemfile Gemfile.lock 2>/dev/null && echo "RUBY" ``` A project may have multiple types (e.g., Python backend + Node frontend). Run audits for all detected types. --- ## Step 2: Run Audit Commands Run the appropriate commands for each detected type. Execute all simultaneously where possible. ### Node.js / npm / yarn / pnpm ```bash # Security vulnerabilities (built-in) npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null # Outdated packages npm outdated --json 2>/dev/null || yarn outdated --json 2>/dev/null # If pnpm pnpm audit --json 2>/dev/null pnpm outdated 2>/dev/null ``` ### Python ```bash # Check outdated (pip) pip list --outdated --format=json 2>/dev/null # Security audit (pip-audit if available, else safety) pip-audit --format=json 2>/dev/null || \ python3 -m pip_audit --format=json 2>/dev/null || \ safety check --json 2>/dev/null || \ echo "Install pip-audit: pip install pip-audit" # Check pyproject.toml / requirements.txt exists cat requirements.txt 2>/dev/null | head -50 cat pyproject.toml 2>/dev/null | head -30 ``` ### Rust ```bash # Security audit cargo audit 2>/dev/null || echo "Install: cargo install cargo-audit" # Outdated cargo outdated 2>/dev/null || echo "Install: cargo install cargo-outdated" ``` ### Go ```bash # Vulnerability check govulncheck ./... 2>/dev/null || echo "Install: go install golang.org/x/vuln/cmd/govulncheck@latest" # List all deps and versions go list -m -json all 2>/dev/null | python3 -c " import sys, json for line in sys.stdin: try: m = json.loads(line) if m.get('Update'): print(f\"{m['Path']}: {m['Version']} → {m['Update']['Version']}\") except: pass " ``` ### Ruby ```bash # Security audit bundle audit check --update 2>/dev/null || echo "Install: gem install bundler-audit" # Outdated gems bundle outdated 2>/dev/null ``` --- ## Step 3: Categorize and Prioritize After collecting all audit output, categorize every finding: ### Severity Tiers | Tier | Criteria | Action | |------|----------|--------| | 🔴 **CRITICAL** | CVE with CVSS ≥ 9.0, or RCE/auth bypass | Fix immediately before any deployment | | 🟠 **HIGH** | CVE with CVSS 7.0–8.9, or data exposure | Fix within this sprint | | 🟡 **MEDIUM** | CVE CVSS 4.0–6.9, or major version outdated | Plan for next sprint | | 🟢 **LOW** | Minor version outdated, no CVE | Batch update quarterly | | ⚪ **INFO** | Dev-only dependency, outdated but no CVE | Optional | ### Breaking Change Detection For each package flagged as outdated, check if the upgrade crosses a major version boundary: - `1.x → 2.x` = **BREAKING** (check CHANGELOG) - `1.2 → 1.9` = likely safe - `0.x → 1.x` = **BREAKING** (pre-1.0 APIs are unstable) Flag any package where current version and latest version have different major numbers. --- ## Step 4: Generate Upgrade Plan Output a structured report with copy-pasteable commands: ```markdown ## Dependency Audit Report Project: [detected type(s)] | Directory: [path] | Date: [today] ### Summary | Severity | Count | |----------|-------| | 🔴 Critical | N | | 🟠 High | N | | 🟡 Medium | N | | 🟢 Low | N | | Total outdated | N | --- ### 🔴 CRITICAL — Fix Immediately **[package-name]** `1.2.3` → `1.2.9` - CVE: CVE-2026-XXXX (CVSS 9.8) — Remote Code Execution via [description] - Fix: `npm install package-name@1.2.9` - Breaking changes: None (patch release) --- ### 🟠 HIGH — Fix This Sprint **[package-name]** `2.1.0` → `3.0.1` ⚠️ MAJOR VERSION CHANGE - CVE: CVE-2026-XXXX (CVSS 7.5) — [description] - Fix: `npm install package-name@3.0.1` - ⚠️ Breaking changes: Check CHANGELOG — v3.0 changes [X] - Migration guide: [URL if findable] --- ### 🟡 MEDIUM — Next Sprint [list] --- ### 🟢 LOW — Batch Update Run all safe patch/minor updates at once: \`\`\`bash # Node: update all non-breaking npx npm-check-updates -u --target minor && npm install # Python: update all non-breaking pip install --upgrade [list of safe packages] \`\`\` --- ### Recommended Fix Order 1. [package] — Critical CVE, patch only, safe 2. [package] — High CVE, test breaking changes first 3. [package] — Medium, can batch with others ``` --- ## Step 5: Quick Fix Mode If the user says "just fix the critical ones" or "auto-fix safe updates", run: ### Node.js — fix critical + non-breaking ```bash # Fix all audit-flagged vulns that have non-breaking fixes npm audit fix # Fix breaking changes only if user confirms npm audit fix --force # ⚠️ ask user first ``` ### Python — fix critical ```bash # Update specific vulnerable packages pip install --upgrade [package1] [package2] ``` ### Verify after fix ```bash # Re-run audit to confirm vulns resolved npm audit 2>/dev/null || pip-audit 2>/dev/null ``` --- ## Edge Cases | Situation | Handling | |-----------|----------| | No package manager installed | Suggest install command, parse manifest file directly | | Monorepo (multiple package.json) | `find . -name "package.json" -not -path "*/node_modules/*"` and audit each | | Private packages | Skip CVE lookup for `@company/` scoped packages, still flag outdated versions | | No internet / offline | Use cached `npm audit` data, note that CVE DB may be stale | | Conflicting peer dependencies | Report conflict, suggest `--legacy-peer-deps` or manual resolution | --- ## Example Output ``` ## Dependency Audit — my-app (Node.js + Python) Date: 2026-03-18 ### Summary 🔴 Critical: 1 🟠 High: 2 🟡 Medium: 4 🟢 Low: 11 --- 🔴 CRITICAL lodash 4.17.15 → 4.17.21 CVE-2021-23337 (CVSS 9.1) — Command injection via template Fix: npm install lodash@4.17.21 Safe: patch release, no breaking changes ✅ --- 🟠 HIGH axios 0.21.1 → 1.6.8 ⚠️ MAJOR VERSION CVE-2023-45857 (CVSS 8.8) — CSRF via forged headers Fix: npm install axios@1.6.8 ⚠️ axios v1.x changed default adapter — test HTTP calls after upgrade --- One-liner to fix critical + high (safe patches only): npm install lodash@4.17.21 npm install axios@1.6.8 # review breaking changes first ``` --- ## Why No Competitor Exists Most security tools (Snyk, Dependabot, Socket.dev) require: - External API keys / account signup - CI/CD pipeline integration - Cloud access to your repo This skill works **entirely locally** — reads your lockfiles, runs your package manager CLI, and gives you the full picture in one pass. No auth, no upload, no account required. --- ## Author **[Canlah AI](https://canlah.ai)** — Run performance marketing without breaking your brand. - GitHub: [github.com/PHY041](https://github.com/PHY041) - All Skills: [clawhub.ai/PHY041](https://clawhub.ai/PHY041)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)