What Dependency File Formats Does SkillSpector Parse? A Complete Guide to Supply Chain Analysis

SkillSpector parses five primary dependency manifest formats—requirements.txt, package.json, pyproject.toml, setup.py, and Pipfile—using specialized extractors in static_patterns_supply_chain.py to identify vulnerable or abandoned packages in Python and Node.js projects.

NVIDIA's SkillSpector is a static supply chain analyzer that examines dependency file formats to surface security risks and abandoned dependencies. Understanding which manifest files SkillSpector supports is essential for developers auditing Python and JavaScript codebases. The tool's parsing logic resides primarily in src/skillspector/nodes/analyzers/static_patterns_supply_chain.py, where dedicated helper functions extract package names, versions, and line numbers from common configuration files.

Supported Dependency File Formats

SkillSpector recognizes both Python and Node.js ecosystems through specific file-type heuristics. The analyzer consolidates detection logic around line 457, where it checks file names against a predefined list to determine which extractor to invoke.

requirements.txt (Python)

The tool processes any file containing the substring "requirements" in its name—including requirements.txt, requirements-dev.txt, or requirements-prod.txt. The helper function _extract_packages_from_requirements handles the parsing logic, extracting tuples of (package_name, version_or_None, line_number) from traditional pip requirement specifiers.

package.json (Node.js/npm)

SkillSpector supports standard npm manifest files through the _extract_packages_from_package_json function. This parser reads the JSON structure and pulls dependencies from dependencies, devDependencies, and peerDependencies objects, capturing both production and development packages.

pyproject.toml (PEP 518/621)

For modern Python projects, SkillSpector treats paths containing "pyproject.toml" as candidates. The analyzer parses both [project] and [tool.poetry] tables to collect package entries, supporting PEP 518/621 compliant projects and Poetry-managed repositories.

setup.py (Legacy Python)

When a file path ends with "setup.py", SkillSpector runs a lightweight AST (Abstract Syntax Tree) inspection to locate the install_requires list. This approach extracts package specifications without executing the Python file, providing safe static analysis of legacy setuptools configurations.

Pipfile (Pipenv)

The analyzer recognizes "pipfile" (case-insensitive) and parses the [packages] and [dev-packages] sections to retrieve dependencies managed by Pipenv. This covers the modern Python packaging workflow that uses Pipfile instead of requirements.txt.

How SkillSpector Detects Dependency Files

The file-type detection block at line 457 in static_patterns_supply_chain.py implements a simple but effective heuristic matching system:

for n in ["requirements", "package.json", "pyproject.toml", "setup.py", "pipfile"]

This loop checks the lower-cased file name against the list, determining which specialized extractor to invoke. The generic "requirements" string ensures that variants like requirements-test.txt or requirements_docs.txt are processed by the requirements parser, providing broad coverage of Python dependency specifications.

Parsing Implementation Details

Extracting Packages from requirements.txt

The _extract_packages_from_requirements function at lines 389-390 parses traditional pip requirement syntax. It handles version specifiers (==, >=, <=, etc.) and extracts line numbers for precise vulnerability tracking.

from skillspector.nodes.analyzers.static_patterns_supply_chain import (
    _extract_packages_from_requirements,
)

content = """\
flask==2.3.2
numpy>=1.21
pyyaml
"""
packages = _extract_packages_from_requirements(content)

# packages -> [('flask', '2.3.2', 1), ('numpy', '1.21', 2), ('pyyaml', None, 3)]

Parsing package.json Dependencies

For Node.js projects, the _extract_packages_from_package_json function at lines 404-405 reads the JSON structure and iterates through dependency objects. It preserves semantic versioning prefixes (like ^ and ~) while recording the line numbers where each dependency appears.

from skillspector.nodes.analyzers.static_patterns_supply_chain import (
    _extract_packages_from_package_json,
)

content = """{
  "dependencies": {
    "express": "^4.17.1",
    "lodash": "4.17.21"
  },
  "devDependencies": {
    "mocha": "9.0.0"
  }
}"""
packages = _extract_packages_from_package_json(content)

# packages -> [('express', '^4.17.1', 2), ('lodash', '4.17.21', 3), ('mocha', '9.0.0', 6)]

Summary

• SkillSpector supports five primary dependency file formats: requirements.txt, package.json, pyproject.toml, setup.py, and Pipfile.
• The detection logic resides in src/skillspector/nodes/analyzers/static_patterns_supply_chain.py around line 457.
• Python projects are covered through requirements.txt (including variants), pyproject.toml (PEP 518/621 and Poetry), setup.py (AST-based extraction), and Pipfile.
• Node.js projects are supported via package.json parsing of dependencies, devDependencies, and peerDependencies.
• Unit tests for these parsers exist in tests/unit/test_patterns_new.py, validating the extraction logic for each format.

Frequently Asked Questions

Which Python dependency formats does SkillSpector support?

SkillSpector supports requirements.txt (and any file containing "requirements" in the name), pyproject.toml, setup.py, and Pipfile. This covers pip, setuptools, Poetry, and Pipenv workflow scenarios according to the source code in static_patterns_supply_chain.py.

How does SkillSpector parse Node.js dependencies?

The analyzer parses package.json files using the _extract_packages_from_package_json function, which extracts packages from dependencies, devDependencies, and peerDependencies objects. It captures both the version strings and their line numbers in the file.

Does SkillSpector handle development dependencies?

Yes. For Node.js, it explicitly parses devDependencies and peerDependencies in package.json. For Python, it recognizes dev-packages in Pipfile and processes any requirements file variant (such as requirements-dev.txt) through the generic requirements parser.

Where is the dependency parsing logic implemented in the codebase?

The core parsing logic resides in src/skillspector/nodes/analyzers/static_patterns_supply_chain.py. The file-type detection occurs around line 457, while the specific extraction helpers _extract_packages_from_requirements and _extract_packages_from_package_json are defined at lines 389-390 and 404-405 respectively.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}