Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
v2.1.1: optimization, reference splits
What This Skill Does
Analyzes dependencies across multi-language projects for security vulnerabilities, license conflicts, outdated packages, and unused dependencies. Supports 8+ ecosystems including JavaScript, Python, Go, Rust, Ruby, Java, PHP, and C#. Includes upgrade path planning and supply chain risk assessment.
Combines vulnerability scanning, license compliance, bloat detection, and upgrade planning across 8+ language ecosystems in one tool, replacing the need for separate per-language auditing utilities.
When to use it
- Scanning a Node.js app for CVEs before a production deploy
- Checking license compatibility before open-sourcing an internal tool
- Finding unused packages to reduce bundle size
- Planning a safe upgrade path across major version bumps
- Detecting maintainer shifts or typosquatting in transitive dependencies
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit my Python project for security issues and license problems
- 1Parse requirements.txt, pyproject.toml, and poetry.lock to build the full dependency tree
- 2Scan each dependency against the built-in CVE database and assign CVSS scores
- 3Classify each license and check for GPL contamination or incompatible combinations
- 4Generate a prioritized report with affected packages, fix versions, and remediation suggestions
A report listing 3 high-severity CVEs with fix versions, 2 license conflicts flagged for legal review, and 5 unused dependencies recommended for removal