Skip to main content
skillsmp

Menú

dependency-audit

Audit a project's dependencies for known vulnerabilities (CVEs) and outdated packages across npm/pnpm/yarn, Go, Python, and Cargo, then produce a prioritized, read-only remediation report. Use when the teammate asks to audit or check dependencies, scan for vulnerable or outdated packages, run a supply-chain / dependency security check, or mentions npm audit, govulncheck, pip-audit, or cargo audit. Read-only — it never edits files or upgrades anything.

Ir a la instalaciónRevisar archivos

Datos de origen

Repositorio
PramodTKodag/claude-code-skills
Última actividad en el origen
29 de septiembre de 2026 a las 11:21
Idioma detectado de SKILL.md
inglés
Estrellas
1
Forks
0

dependency-audit: report vulnerable and outdated dependencies

Inspect a project’s dependency ecosystems, run their vulnerability and outdated-package tools, and produce a prioritized remediation report. The audit itself keeps manifests, lockfiles and code unchanged.

Prerequisites

The source covers npm/pnpm/yarn, Go, Python and Cargo projects. Each detected ecosystem needs its corresponding audit tool; unavailable tools are reported as not run.

How to use

Provide the project to audit or ask to check its dependencies. The workflow detects manifests and lockfiles, runs the native tools once, and summarizes severity, installed and fixed versions, advisory IDs and dependency paths. It separates patch or minor recommendations from changes needing review.

Limitations

The Skill reports and proposes; it does not install upgrades or apply fixes. A missing audit tool is not a passing result. Advisory IDs, severities and fixed versions must come from the actual tool output.

Sources

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos
2 archivos

Mostrando SKILL.md

SKILL.md
Instrucciones de origen · Vista previa de solo lectura
name
dependency-audit
description
Audit a project's dependencies for known vulnerabilities (CVEs) and outdated packages across npm/pnpm/yarn, Go, Python, and Cargo, then produce a prioritized, read-only remediation report. Use when the teammate asks to audit or check dependencies, scan for vulnerable or outdated packages, run a supply-chain / dependency security check, or mentions npm audit, govulncheck, pip-audit, or cargo audit. Read-only — it never edits files or upgrades anything.
user-invocable
true
allowed-tools
["Read","Grep","Glob","Bash(npm audit*)","Bash(npm outdated*)","Bash(pnpm audit*)","Bash(pnpm outdated*)","Bash(yarn audit*)","Bash(yarn outdated*)","Bash(govulncheck*)","Bash(go list*)","Bash(pip-audit*)","Bash(pip list*)","Bash(uv*)","Bash(cargo audit*)","Bash(cargo outdated*)","Bash(jq*)"]
effort
medium
# Dependency audit Scan the dependency graph for **known vulnerabilities** and **outdated packages**, then hand back one prioritized report. **Read-only**: run audit tools, never modify manifests, lockfiles, or code — the teammate (or `/dev-flow`) applies fixes. ## Procedure 1. **Detect ecosystems.** Glob for manifests — `package.json`, `pnpm-lock.yaml`/`yarn.lock`, `go.mod`, `requirements.txt`/`pyproject.toml`, `Cargo.toml`. Report which were found; audit only those. 2. **Run each ecosystem's native tools once** — the exact audit + outdated commands, their `jq` extraction filters, and install hints are in [references/ecosystems.md](references/ecosystems.md). Prefer the tool the lockfile implies (`pnpm` over `npm` when `pnpm-lock.yaml` exists, etc.). 3. **Missing tool = "not run", never a silent pass.** If an audit tool isn't installed, list it under *Tools not run* with the one-line install from the reference; do not infer results from the manifest. 4. **Synthesize** the outputs into the report below. Then stop — propose, don't apply. ## Token discipline (required) - **Never** paste raw `audit`/`outdated` JSON into the conversation. Always pipe it through the `jq` filter in the reference to keep only `{package, severity, id, installed, fixed, path}`, then work from that. - Run each tool **once**; capture the filtered summary and discard the raw output. - Read manifests with `grep`/targeted reads, never whole large lockfiles. - Load `references/ecosystems.md` only when you need a command you don't already have. ## Output Report, most severe first: - **Summary:** `N vulnerabilities (c critical / h high / m moderate / l low), M outdated` across the ecosystems scanned. - **Vulnerabilities** — table: `severity · package · installed → fixed · advisory/CVE · dependency path`. - **Outdated** — table: `package · current → latest · jump (patch / minor / major)`. - **Prioritized remediation:** 1. **Safe now** — patch/minor upgrades that fix a vuln or are low-risk, each with the **exact command**. 2. **Needs review** — major/breaking upgrades, flagged separately with why (API break, transitive pin). - **Tools not run** — any ecosystem whose audit tool was missing, with the install hint. State clearly that nothing was changed. If the teammate wants the fixes applied, recommend running them through `/dev-flow` (or manually) — this skill does not upgrade. ## Guardrails - Read-only: no `Edit`/`Write`, no `npm install`/upgrade, no lockfile changes. - Report severities and versions **as the tools report them** — do not guess CVE IDs or fixed versions. - If a scanned ecosystem has zero findings, say so explicitly rather than omitting it.
Ver en GitHub
Volver a la búsquedaVolver a la instalación