| name | deps-audit |
| description | Read-only dependency, CVE, license, and maintenance audit. |
| argument-hint | package manifests, lockfiles, or project root |
| license | MIT |
| metadata | {"category":"quality","tags":["dependencies","supply-chain","licenses"],"effort":"medium","side_effect":"read-only","explicit_invocation":false} |
Dependency Audit
Audit dependency manifests and lockfiles.
The canonical rubric lives in docs/rubrics/deps.md. Use it as the source of truth.
Process
- Detect package managers and lockfiles.
- Use local audit tools when available.
- Check for known vulnerable packages, abandoned packages, risky licenses, duplicate frameworks, unpinned Docker base images, and missing lockfiles.
- Identify whether dependency audit can run in CI.
- Report actionable upgrades and accepted-risk options.
Self-validation
Before final output, verify:
- Route, side-effect, and confirmation requirements match metadata.
- Required artifacts or read-only result are explicit.
- Verification, blockers, and next route are stated.
Rules
- Read-only by default.
- Do not mutate lockfiles unless remediation is explicitly requested.
- If network access is unavailable, report the local-only limitation.
- If the rubric and this skill conflict, follow the rubric and update this skill later.
- For deployable products, dependency gate cannot pass unless lockfiles or an explicit no-lockfile rationale exist.