| name | dependency-audit |
| description | Audits dependencies for known vulnerabilities and outdated packages |
| user-invocable | true |
| allowed-tools | Bash Read |
| effort | low |
Dependency Audit
- Run security audit:
npm audit --json 2>/dev/null | head -100 \
|| bun audit 2>/dev/null \
|| pip audit 2>/dev/null \
|| cargo audit 2>/dev/null
- Check for outdated packages:
npm outdated 2>/dev/null || bun outdated 2>/dev/null
-
Categorize findings:
- Critical/High CVEs - list with CVE ID, affected version, fixed version
- Outdated major versions - breaking changes to watch for
- Outdated minor/patch - safe to update
-
For Critical/High vulnerabilities:
- Can it be fixed with
npm audit fix?
- Is there a workaround if no fix exists?
- Is the vulnerable code path even reachable in this project?
-
Generate an update plan:
Safe to auto-update now: X packages
Requires manual review: Y packages
No fix available: Z packages (mitigations: ...)
Ask before running any updates.