dependency-analysis-patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dependency-analysis-patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
# npm
npx depcruise --output-type dot src/ | dot -T svg > deps.svg
# Python
pipdeptree --graph-output svg > deps.svg
# Go
go mod graph | modgraphviz | dot -T svg > deps.svg# JavaScript/TypeScript
npx madge --circular src/
npx dpdm --circular src/index.ts
# Python
pydeps --cluster --no-show src/| Circular Tip | Çözüm |
|---|---|
| A → B → A | Interface/port ile inversion |
| A → B → C → A | Shared module extract et |
| Barrel file circular | Direct import kullan |
# npm
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical")'
# pip
pip-audit --format json --desc
# Go
govulncheck ./...
# Multi-tool
trivy fs --severity CRITICAL,HIGH .| CVSS | Severity | Aksiyon | SLA |
|---|---|---|---|
| 9.0+ | Critical | Hotfix | 24h |
| 7.0-8.9 | High | Sprint fix | 1 hafta |
| 4.0-6.9 | Medium | Backlog | 1 ay |
| <4.0 | Low | Track | Fırsatçı |
# npm
npx license-checker --production --json --failOn "GPL-3.0;AGPL-3.0"
# Python
pip-licenses --format=json --fail-on="GPL-3.0"| License | Commercial OK | Copyleft | Risk |
|---|---|---|---|
| MIT | Evet | Hayır | Düşük |
| Apache-2.0 | Evet | Hayır | Düşük |
| BSD-3 | Evet | Hayır | Düşük |
| MPL-2.0 | Evet | Kısmi | Orta |
| LGPL | Dikkat | Kısmi | Orta |
| GPL-3.0 | Dikkat | Evet | Yüksek |
| AGPL-3.0 | Dikkat | Evet | Çok yüksek |
# npm - outdated
npm outdated --json
# Semver risk
# patch (0.0.x) → güvenli
# minor (0.x.0) → genelde güvenli
# major (x.0.0) → breaking change riski
# Test after update
npm update <pkg> && npm testnpm audit / pip-audit temiz (critical/high yok)depcheck)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.