メニュー
Use when reviewing third-party dependencies for known CVEs, suspicious transitive packages, lockfile drift, or license risk. Pairs with local-vulnerability-hunt for full coverage.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | dependency-audit |
| description | Use when reviewing third-party dependencies for known CVEs, suspicious transitive packages, lockfile drift, or license risk. Pairs with local-vulnerability-hunt for full coverage. |
| version | 1.0.0 |
| author | kbot |
| license | MIT |
| metadata | {"kbot":{"tags":["security","dependencies","supply-chain","npm","audit"],"related_skills":["local-vulnerability-hunt","secrets-leak-scan","ship-pipeline"]}} |
Most exploits in 2026 do not come from your code. They come from a package six links deep that someone trusted on a Tuesday.
node_modules is bigger than the rest of the repoLOCKFILE IS THE TRUTH. PACKAGE.JSON IS THE WISH.
TRANSITIVE COUNTS. DEEP COUNTS DOUBLE.
npm ls --all --json > /tmp/deps.json
Then count:
npm audit --json > /tmp/audit.json
Triage by severity. Critical and high get fixed this PR; medium gets a ticket; low gets a note. Read every advisory body — npm audit lies about exploitability often enough to matter.
For each package above the trust line (default: anything in dependencies, not devDependencies):
provenance field present in the npm metadata?A rotated maintainer + a fresh release is the classic supply-chain shape. Treat it as suspicious until proven otherwise.
When reviewing a PR:
git diff main -- package-lock.json | grep -E '^\+.*"version"' | head -50
Any new package, any version bump in a security-relevant package (auth, crypto, http, vm, fs), and any registry change deserves a manual look.
# Dependency Audit — <date>
- Direct: N | Transitive: M
- CVEs: critical=X, high=Y, medium=Z, low=W
- Suspicious provenance: [list of packages]
- Lockfile diff: [N packages changed]
## Action items
- [ ] Upgrade <pkg> from <a> to <b> (CVE-XXXX-YYYY)
- [ ] Replace <pkg> with <alt> (unmaintained)
- [ ] Pin <pkg> at <version> (recent maintainer change)
File under ~/.kbot/security-audits/<session-id>/dependency-audit.md.
npm audit fix on autopilot — it can pull breaking majorsbash — drive npm ls, npm audit, git diffkbot_read — open the package's index.js to see what it actually doeslocal-vulnerability-hunt — once a package is confirmed in scope, audit how you use itCreates distinctive editorial art direction for kernel.chat issues before implementation. Use when choosing an issue's visual concept, typography, composition, cover system, media grammar, responsive transformation, or motion intent; when a page feels generic or lacks character; or when original image and video assets need one coherent visual language.
Audits kernel.chat pages for responsive visual craft, accessibility, motion safety, interaction truth, runtime health, and production rendering. Use when reviewing an issue or artifact, checking whether a design is finished, comparing desktop and mobile, validating reduced motion or print, finding overflow and broken media, or proving that a published route matches the build.
Guides the design, layout, styling, and interactivity of kernel.chat editorial spreads and standalone artifact editions. Use this skill when editing or creating pages, React components, CSS files, or single-file HTML artifacts in the kernel.chat project to enforce the POPEYE-inspired bilingual design grammar and the interaction-language/artifact-language laws.
Use this skill to generate well-branded editorial interfaces and assets for kernel.chat ("Magazine for City Coders" — an independent magazine that is an unnamed homage to POPEYE), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and editorial UI components for prototyping.
Hand off a model from Blender (via BlenderMCP) into Unity (via MCP for Unity) — export the current Blender model, import it through import_model_file, and place it in the open scene. Use when the user has BlenderMCP and MCP for Unity both connected and wants to bring a Blender model into Unity. Does NOT drive Blender's own generators; BlenderMCP owns how the model got into Blender.
Generate images/videos/3D assets/audio via Higgsfield AI. Defaults: GPT Image 2 for image/design/text, Seedance 2.0 for video, Nano Banana 2/Lite/Pro for character/reference images, Marketing Studio for ads, Seed Audio 1.0 for audio. Use when: "generate an image", "make a video", "animate this photo", "image-to-video", "edit/stylize/remix this image", "reframe this video", "edit this video from a sketch", "create a 3D model/GLB", "create a sound effect", "make music", "text-to-audio", "create an ad", "make a UGC video", "unboxing", "presenter video", "import product from URL", or "analyze video virality". Supports image-to-3D (`multi_image_to_3d`), text-to-audio/music (`seed_audio`), workflow generation (`draw_to_video`, `reframe`), Marketing Studio, and Virality Predictor (`brain_activity`). Chain with higgsfield-soul-id for face/identity consistency. NOT for: Soul Character training (use higgsfield-soul-id), product photoshoots, marketplace listing cards, text/chat/TTS tasks.