dependency-audit

name	dependency-audit
description	Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.
license	MIT
compatibility	Requires pip or npm/yarn/pnpm

Process

1. Identify the package manager. Look for:

   • requirements.txt / pyproject.toml / Pipfile → Python (pip/uv)
   • package.json → Node.js (npm/yarn/pnpm)
   • go.mod → Go
   • Cargo.toml → Rust

2. Run vulnerability scan.

   • Python: pip audit or uvx pip-audit
   • Node.js: npm audit or npx better-npm-audit audit
   • Go: govulncheck ./...

3. Check for outdated packages.

   • Python: pip list --outdated
   • Node.js: npm outdated

4. License audit. Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:

   • Python: uvx pip-licenses --order=license
   • Node.js: npx license-checker --summary

5. Identify unused dependencies.

   • Python: Check each import with grep -r "import <package>" src/
   • Node.js: npx depcheck

6. Write the report as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).

Rationalizations

Excuse	Rebuttal
"We'll update dependencies later"	Known vulnerabilities are actively exploited. Flag them now.
"It's a dev dependency, it doesn't matter"	Dev dependencies run in CI and on developer machines — they are attack surface.
"Removing unused deps might break something"	If nothing imports it, nothing uses it. Remove it.

Verification

• Vulnerability scan was executed (not estimated)
• Every critical/high vulnerability has a recommended action (update version or replace package)
• License compatibility was checked against the project's license