| name | deps-audit |
| description | Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for yarn, pnpm, or bun projects (npm only), or for reviewing code quality. |
Dependency Audit
Commands
Run in parallel:
Workflow
- Run audit and outdated check in parallel
- Report vulnerabilities with CVE + fix command using severity table below
- List outdated packages: table of package/current/latest/type (major vs minor/patch)
- Check for unused deps: grep imports in
src/
Severity Levels
| Level | CVSS | Action |
|---|
| Critical | 9.0-10.0 | Fix immediately, block merge |
| High | 7.0-8.9 | Fix before next release |
| Moderate | 4.0-6.9 | Fix in current sprint |
| Low | 0.1-3.9 | Fix when convenient |
For each critical/high vulnerability report:
Package: <name>@<version>
CVE: CVE-YYYY-XXXXX
Severity: Critical
Description: <one line>
Fix: npm audit fix --force (or: npm install <pkg>@<safe-version>)
Rules
- Never use
npx directly
- Focus on actionable items
- Prioritize: security > major updates > unused > minor updates
Error Handling
npm audit fails -- run npm install first to generate package-lock.json, then retrynpm outdated returns nothing -- report all dependencies are currentnpm not found -- report incompatibility; this skill requires npm
