@diottodev/runic 1.0.0 → 1.1.0

package/engineering/skills/dependency-auditor/SKILL.md

@@ -0,0 +1,338 @@
+---
+name: "dependency-auditor"
+description: "Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review."
+---
+
+# Dependency Auditor
+
+> **Skill Type:** POWERFUL  
+> **Category:** Engineering  
+> **Domain:** Dependency Management & Security  
+
+## Overview
+
+The **Dependency Auditor** is a comprehensive toolkit for analyzing, auditing, and managing dependencies across multi-language software projects. This skill provides deep visibility into your project's dependency ecosystem, enabling teams to identify vulnerabilities, ensure license compliance, optimize dependency trees, and plan safe upgrades.
+
+In modern software development, dependencies form complex webs that can introduce significant security, legal, and maintenance risks. A single project might have hundreds of direct and transitive dependencies, each potentially introducing vulnerabilities, license conflicts, or maintenance burden. This skill addresses these challenges through automated analysis and actionable recommendations.
+
+## Core Capabilities
+
+### 1. Vulnerability Scanning & CVE Matching
+
+**Comprehensive Security Analysis**
+- Scans dependencies against built-in vulnerability databases
+- Matches Common Vulnerabilities and Exposures (CVE) patterns
+- Identifies known security issues across multiple ecosystems
+- Analyzes transitive dependency vulnerabilities
+- Provides CVSS scores and exploit assessments
+- Tracks vulnerability disclosure timelines
+- Maps vulnerabilities to dependency paths
+
+**Multi-Language Support**
+- **JavaScript/Node.js**: package.json, package-lock.json, yarn.lock
+- **Python**: requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock
+- **Go**: go.mod, go.sum
+- **Rust**: Cargo.toml, Cargo.lock
+- **Ruby**: Gemfile, Gemfile.lock
+- **Java/Maven**: pom.xml, gradle.lockfile
+- **PHP**: composer.json, composer.lock
+- **C#/.NET**: packages.config, project.assets.json
+
+### 2. License Compliance & Legal Risk Assessment
+
+**License Classification System**
+- **Permissive Licenses**: MIT, Apache 2.0, BSD (2-clause, 3-clause), ISC
+- **Copyleft (Strong)**: GPL (v2, v3), AGPL (v3)
+- **Copyleft (Weak)**: LGPL (v2.1, v3), MPL (v2.0)
+- **Proprietary**: Commercial, custom, or restrictive licenses
+- **Dual Licensed**: Multi-license scenarios and compatibility
+- **Unknown/Ambiguous**: Missing or unclear licensing
+
+**Conflict Detection**
+- Identifies incompatible license combinations
+- Warns about GPL contamination in permissive projects
+- Analyzes license inheritance through dependency chains
+- Provides compliance recommendations for distribution
+- Generates legal risk matrices for decision-making
+
+### 3. Outdated Dependency Detection
+
+**Version Analysis**
+- Identifies dependencies with available updates
+- Categorizes updates by severity (patch, minor, major)
+- Detects pinned versions that may be outdated
+- Analyzes semantic versioning patterns
+- Identifies floating version specifiers
+- Tracks release frequencies and maintenance status
+
+**Maintenance Status Assessment**
+- Identifies abandoned or unmaintained packages
+- Analyzes commit frequency and contributor activity
+- Tracks last release dates and security patch availability
+- Identifies packages with known end-of-life dates
+- Assesses upstream maintenance quality
+
+### 4. Dependency Bloat Analysis
+
+**Unused Dependency Detection**
+- Identifies dependencies that aren't actually imported/used
+- Analyzes import statements and usage patterns
+- Detects redundant dependencies with overlapping functionality
+- Identifies oversized packages for simple use cases
+- Maps actual vs. declared dependency usage
+
+**Redundancy Analysis**
+- Identifies multiple packages providing similar functionality
+- Detects version conflicts in transitive dependencies
+- Analyzes bundle size impact of dependencies
+- Identifies opportunities for dependency consolidation
+- Maps dependency overlap and duplication
+
+### 5. Upgrade Path Planning & Breaking Change Risk
+
+**Semantic Versioning Analysis**
+- Analyzes semver patterns to predict breaking changes
+- Identifies safe upgrade paths (patch/minor versions)
+- Flags major version updates requiring attention
+- Tracks breaking changes across dependency updates
+- Provides rollback strategies for failed upgrades
+
+**Risk Assessment Matrix**
+- Low Risk: Patch updates, security fixes
+- Medium Risk: Minor updates with new features
+- High Risk: Major version updates, API changes
+- Critical Risk: Dependencies with known breaking changes
+
+**Upgrade Prioritization**
+- Security patches: Highest priority
+- Bug fixes: High priority
+- Feature updates: Medium priority
+- Major rewrites: Planned priority
+- Deprecated features: Immediate attention
+
+### 6. Supply Chain Security
+
+**Dependency Provenance**
+- Verifies package signatures and checksums
+- Analyzes package download sources and mirrors
+- Identifies suspicious or compromised packages
+- Tracks package ownership changes and maintainer shifts
+- Detects typosquatting and malicious packages
+
+**Transitive Risk Analysis**
+- Maps complete dependency trees
+- Identifies high-risk transitive dependencies
+- Analyzes dependency depth and complexity
+- Tracks influence of indirect dependencies
+- Provides supply chain risk scoring
+
+### 7. Lockfile Analysis & Deterministic Builds
+
+**Lockfile Validation**
+- Ensures lockfiles are up-to-date with manifests
+- Validates integrity hashes and version consistency
+- Identifies drift between environments
+- Analyzes lockfile conflicts and resolution strategies
+- Ensures deterministic, reproducible builds
+
+**Environment Consistency**
+- Compares dependencies across environments (dev/staging/prod)
+- Identifies version mismatches between team members
+- Validates CI/CD environment consistency
+- Tracks dependency resolution differences
+
+## Technical Architecture
+
+### Scanner Engine (`dep_scanner.py`)
+- Multi-format parser supporting 8+ package ecosystems
+- Built-in vulnerability database with 500+ CVE patterns
+- Transitive dependency resolution from lockfiles
+- JSON and human-readable output formats
+- Configurable scanning depth and exclusion patterns
+
+### License Analyzer (`license_checker.py`)
+- License detection from package metadata and files
+- Compatibility matrix with 20+ license types
+- Conflict detection engine with remediation suggestions
+- Risk scoring based on distribution and usage context
+- Export capabilities for legal review
+
+### Upgrade Planner (`upgrade_planner.py`)
+- Semantic version analysis with breaking change prediction
+- Dependency ordering based on risk and interdependence
+- Migration checklists with testing recommendations
+- Rollback procedures for failed upgrades
+- Timeline estimation for upgrade cycles
+
+## Use Cases & Applications
+
+### Security Teams
+- **Vulnerability Management**: Continuous scanning for security issues
+- **Incident Response**: Rapid assessment of vulnerable dependencies
+- **Supply Chain Monitoring**: Tracking third-party security posture
+- **Compliance Reporting**: Automated security compliance documentation
+
+### Legal & Compliance Teams
+- **License Auditing**: Comprehensive license compliance verification
+- **Risk Assessment**: Legal risk analysis for software distribution
+- **Due Diligence**: Dependency licensing for M&A activities
+- **Policy Enforcement**: Automated license policy compliance
+
+### Development Teams
+- **Dependency Hygiene**: Regular cleanup of unused dependencies
+- **Upgrade Planning**: Strategic dependency update scheduling
+- **Performance Optimization**: Bundle size optimization through dep analysis
+- **Technical Debt**: Identifying and prioritizing dependency technical debt
+
+### DevOps & Platform Teams
+- **Build Optimization**: Faster builds through dependency optimization
+- **Security Automation**: Automated vulnerability scanning in CI/CD
+- **Environment Consistency**: Ensuring consistent dependencies across environments
+- **Release Management**: Dependency-aware release planning
+
+## Integration Patterns
+
+### CI/CD Pipeline Integration
+```bash
+# Security gate in CI
+python dep_scanner.py /project --format json --fail-on-high
+python license_checker.py /project --policy strict --format json
+```
+
+### Scheduled Audits
+```bash
+# Weekly dependency audit
+./audit_dependencies.sh > weekly_report.html
+python upgrade_planner.py deps.json --timeline 30days
+```
+
+### Development Workflow
+```bash
+# Pre-commit dependency check
+python dep_scanner.py . --quick-scan
+python license_checker.py . --warn-conflicts
+```
+
+## Advanced Features
+
+### Custom Vulnerability Databases
+- Support for internal/proprietary vulnerability feeds
+- Custom CVE pattern definitions
+- Organization-specific risk scoring
+- Integration with enterprise security tools
+
+### Policy-Based Scanning
+- Configurable license policies by project type
+- Custom risk thresholds and escalation rules
+- Automated policy enforcement and notifications
+- Exception management for approved violations
+
+### Reporting & Dashboards
+- Executive summaries for management
+- Technical reports for development teams
+- Trend analysis and dependency health metrics
+- Integration with project management tools
+
+### Multi-Project Analysis
+- Portfolio-level dependency analysis
+- Shared dependency impact analysis
+- Organization-wide license compliance
+- Cross-project vulnerability propagation
+
+## Best Practices
+
+### Scanning Frequency
+- **Security Scans**: Daily or on every commit
+- **License Audits**: Weekly or monthly
+- **Upgrade Planning**: Monthly or quarterly
+- **Full Dependency Audit**: Quarterly
+
+### Risk Management
+1. **Prioritize Security**: Address high/critical CVEs immediately
+2. **License First**: Ensure compliance before functionality
+3. **Gradual Updates**: Incremental dependency updates
+4. **Test Thoroughly**: Comprehensive testing after updates
+5. **Monitor Continuously**: Automated monitoring and alerting
+
+### Team Workflows
+1. **Security Champions**: Designate dependency security owners
+2. **Review Process**: Mandatory review for new dependencies
+3. **Update Cycles**: Regular, scheduled dependency updates
+4. **Documentation**: Maintain dependency rationale and decisions
+5. **Training**: Regular team education on dependency security
+
+## Metrics & KPIs
+
+### Security Metrics
+- Mean Time to Patch (MTTP) for vulnerabilities
+- Number of high/critical vulnerabilities
+- Percentage of dependencies with known vulnerabilities
+- Security debt accumulation rate
+
+### Compliance Metrics
+- License compliance percentage
+- Number of license conflicts
+- Time to resolve compliance issues
+- Policy violation frequency
+
+### Maintenance Metrics
+- Percentage of up-to-date dependencies
+- Average dependency age
+- Number of abandoned dependencies
+- Upgrade success rate
+
+### Efficiency Metrics
+- Bundle size reduction percentage
+- Unused dependency elimination rate
+- Build time improvement
+- Developer productivity impact
+
+## Troubleshooting Guide
+
+### Common Issues
+1. **False Positives**: Tuning vulnerability detection sensitivity
+2. **License Ambiguity**: Resolving unclear or multiple licenses
+3. **Breaking Changes**: Managing major version upgrades
+4. **Performance Impact**: Optimizing scanning for large codebases
+
+### Resolution Strategies
+- Whitelist false positives with documentation
+- Contact maintainers for license clarification
+- Implement feature flags for risky upgrades
+- Use incremental scanning for large projects
+
+## Future Enhancements
+
+### Planned Features
+- Machine learning for vulnerability prediction
+- Automated dependency update pull requests
+- Integration with container image scanning
+- Real-time dependency monitoring dashboards
+- Natural language policy definition
+
+### Ecosystem Expansion
+- Additional language support (Swift, Kotlin, Dart)
+- Container and infrastructure dependencies
+- Development tool and build system dependencies
+- Cloud service and SaaS dependency tracking
+
+---
+
+## Quick Start
+
+```bash
+# Scan project for vulnerabilities and licenses
+python scripts/dep_scanner.py /path/to/project
+
+# Check license compliance
+python scripts/license_checker.py /path/to/project --policy strict
+
+# Plan dependency upgrades
+python scripts/upgrade_planner.py deps.json --risk-threshold medium
+```
+
+For detailed usage instructions, see [README.md](README.md).
+
+---
+
+*This skill provides comprehensive dependency management capabilities essential for maintaining secure, compliant, and efficient software projects. Regular use helps teams stay ahead of security threats, maintain legal compliance, and optimize their dependency ecosystems.*

package/engineering/skills/dependency-auditor/assets/sample_go.mod

@@ -0,0 +1,53 @@
+module github.com/example/sample-go-service
+
+go 1.20
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	github.com/go-redis/redis/v8 v8.11.5
+	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/gorilla/mux v1.8.0
+	github.com/gorilla/websocket v1.5.0
+	github.com/lib/pq v1.10.9
+	github.com/stretchr/testify v1.8.2
+	go.uber.org/zap v1.24.0
+	golang.org/x/crypto v0.9.0
+	gopkg.in/yaml.v3 v3.0.1
+	gorm.io/driver/postgres v1.5.0
+	gorm.io/gorm v1.25.1
+)
+
+require (
+	github.com/bytedance/sonic v1.8.8 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.13.0 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgx/v5 v5.3.1 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
+	github.com/leodido/go-urn v1.2.4 // indirect
+	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.7 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.11 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/arch v0.3.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+)

package/engineering/skills/dependency-auditor/assets/sample_package.json

@@ -0,0 +1,72 @@
+{
+  "name": "sample-web-app",
+  "version": "1.2.3",
+  "description": "A sample web application with various dependencies for testing dependency auditing",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js",
+    "dev": "nodemon index.js",
+    "build": "webpack --mode production",
+    "test": "jest",
+    "lint": "eslint src/",
+    "audit": "npm audit"
+  },
+  "keywords": ["web", "app", "sample", "dependency", "audit"],
+  "author": "Claude Skills Team",
+  "license": "MIT",
+  "dependencies": {
+    "express": "4.18.1",
+    "lodash": "4.17.20",
+    "axios": "1.5.0",
+    "jsonwebtoken": "8.5.1",
+    "bcrypt": "5.1.0",
+    "mongoose": "6.10.0",
+    "cors": "2.8.5",
+    "helmet": "6.1.5",
+    "winston": "3.8.2",
+    "dotenv": "16.0.3",
+    "express-rate-limit": "6.7.0",
+    "multer": "1.4.5-lts.1",
+    "sharp": "0.32.1",
+    "nodemailer": "6.9.1",
+    "socket.io": "4.6.1",
+    "redis": "4.6.5",
+    "moment": "2.29.4",
+    "chalk": "4.1.2",
+    "commander": "9.4.1"
+  },
+  "devDependencies": {
+    "nodemon": "2.0.22",
+    "jest": "29.5.0",
+    "supertest": "6.3.3",
+    "eslint": "8.40.0",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-plugin-import": "2.27.5",
+    "webpack": "5.82.1",
+    "webpack-cli": "5.1.1",
+    "babel-loader": "9.1.2",
+    "@babel/core": "7.22.1",
+    "@babel/preset-env": "7.22.2",
+    "css-loader": "6.7.4",
+    "style-loader": "3.3.3",
+    "html-webpack-plugin": "5.5.1",
+    "mini-css-extract-plugin": "2.7.6",
+    "postcss": "8.4.23",
+    "postcss-loader": "7.3.0",
+    "autoprefixer": "10.4.14",
+    "cross-env": "7.0.3",
+    "rimraf": "5.0.1"
+  },
+  "engines": {
+    "node": ">=16.0.0",
+    "npm": ">=8.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/example/sample-web-app.git"
+  },
+  "bugs": {
+    "url": "https://github.com/example/sample-web-app/issues"
+  },
+  "homepage": "https://github.com/example/sample-web-app#readme"
+}

package/engineering/skills/dependency-auditor/assets/sample_requirements.txt

@@ -0,0 +1,71 @@
+# Core web framework
+Django==4.1.7
+djangorestframework==3.14.0
+django-cors-headers==3.14.0
+django-environ==0.10.0
+django-extensions==3.2.1
+
+# Database and ORM
+psycopg2-binary==2.9.6
+redis==4.5.4
+celery==5.2.7
+
+# Authentication and Security
+django-allauth==0.54.0
+djangorestframework-simplejwt==5.2.2
+cryptography==40.0.1
+bcrypt==4.0.1
+
+# HTTP and API clients
+requests==2.28.2
+httpx==0.24.1
+urllib3==1.26.15
+
+# Data processing and analysis
+pandas==2.0.1
+numpy==1.24.3
+Pillow==9.5.0
+openpyxl==3.1.2
+
+# Monitoring and logging
+sentry-sdk==1.21.1
+structlog==23.1.0
+
+# Testing
+pytest==7.3.1
+pytest-django==4.5.2
+pytest-cov==4.0.0
+factory-boy==3.2.1
+freezegun==1.2.2
+
+# Development tools
+black==23.3.0
+flake8==6.0.0
+isort==5.12.0
+pre-commit==3.3.2
+django-debug-toolbar==4.0.0
+
+# Documentation
+Sphinx==6.2.1
+sphinx-rtd-theme==1.2.0
+
+# Deployment and server
+gunicorn==20.1.0
+whitenoise==6.4.0
+
+# Environment and configuration
+python-decouple==3.8
+pyyaml==6.0
+
+# Utilities
+click==8.1.3
+python-dateutil==2.8.2
+pytz==2023.3
+six==1.16.0
+
+# AWS integration
+boto3==1.26.137
+botocore==1.29.137
+
+# Email
+django-anymail==10.0

package/engineering/skills/dependency-auditor/expected_outputs/sample_license_report.txt

@@ -0,0 +1,37 @@
+============================================================
+LICENSE COMPLIANCE REPORT
+============================================================
+Analysis Date: 2024-02-16T15:30:00.000Z
+Project: /example/sample-web-app
+Project License: MIT
+
+SUMMARY:
+  Total Dependencies: 23
+  Compliance Score: 92.5/100
+  Overall Risk: LOW
+  License Conflicts: 0
+
+LICENSE DISTRIBUTION:
+  Permissive: 21
+  Copyleft_weak: 1
+  Copyleft_strong: 0
+  Proprietary: 0
+  Unknown: 1
+
+RISK BREAKDOWN:
+  Low: 21
+  Medium: 1
+  High: 0
+  Critical: 1
+
+HIGH-RISK DEPENDENCIES:
+------------------------------
+  moment v2.29.4: Unknown (CRITICAL)
+
+RECOMMENDATIONS:
+--------------------
+1. Investigate and clarify licenses for 1 dependencies with unknown licensing
+2. Overall compliance score is high - maintain current practices
+3. Consider updating moment.js which has been deprecated by maintainers
+
+============================================================

package/engineering/skills/dependency-auditor/expected_outputs/sample_upgrade_plan.txt

@@ -0,0 +1,59 @@
+============================================================
+DEPENDENCY UPGRADE PLAN
+============================================================
+Generated: 2024-02-16T15:30:00.000Z
+Timeline: 90 days
+
+UPGRADE SUMMARY:
+  Total Upgrades Available: 12
+  Security Updates: 2
+  Major Version Updates: 3
+  High Risk Updates: 2
+
+RISK ASSESSMENT:
+  Overall Risk Level: MEDIUM
+  Key Risk Factors:
+    • 2 critical risk upgrades requiring careful planning
+    • Core framework upgrades: ['express', 'webpack', 'eslint']
+    • 1 major version upgrades with potential breaking changes
+
+TOP PRIORITY UPGRADES:
+------------------------------
+🔒 lodash: 4.17.20 → 4.17.21 🔒
+   Type: Patch | Risk: Low | Priority: 95.0
+   Security: CVE-2021-23337: Prototype pollution vulnerability
+
+🟡 express: 4.18.1 → 4.18.2
+   Type: Patch | Risk: Low | Priority: 85.0
+
+🟡 webpack: 5.82.1 → 5.88.0
+   Type: Minor | Risk: Medium | Priority: 75.0
+
+🔴 eslint: 8.40.0 → 9.0.0
+   Type: Major | Risk: High | Priority: 65.0
+
+🟢 cors: 2.8.5 → 2.8.7
+   Type: Patch | Risk: Safe | Priority: 80.0
+
+PHASED UPGRADE PLANS:
+------------------------------
+Phase 1: Security & Safe Updates (30 days)
+  Dependencies: lodash, cors, helmet, dotenv, bcrypt
+  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands
+
+Phase 2: Regular Updates (36 days)
+  Dependencies: express, axios, winston, multer
+  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands
+
+Phase 3: Major Updates (30 days)
+  Dependencies: webpack, eslint, jest
+  ... and 2 more
+  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands
+
+RECOMMENDATIONS:
+--------------------
+1. URGENT: 2 security updates available - prioritize immediately
+2. Quick wins: 6 safe updates can be applied with minimal risk
+3. Plan carefully: 2 high-risk upgrades need thorough testing
+
+============================================================