code-dep-audit

# /code:dep-audit Audit project dependencies for vulnerabilities and freshness. ## When to Use This Skill | Use this skill when... | Use something else when... | |---|---| | Checking for known CVEs in dependencies | Setting up security scanning CI → /configure:security | | Preparing a release and need dep health check | Looking for code-level security issues → /code:antipatterns | | Responding to a vulnerability advisory | Reviewing code quality → /code:review | | Auditing license compliance | Configuring dependency management → /configure:package-management | ## Context - Package files: !`find . -maxdepth 1 \( -name "package.json" -o -name "package-lock.json" -o -name "yarn.lock" -o -name "bun.lock" -o -name "bun.lockb" -o -name "pyproject.toml" -o -name "requirements.txt" -o -name "Cargo.toml" -o -name "Cargo.lock" -o -name "go.mod" -o -name "go.sum" \) -type f` ## Parameters - `--type`: Audit type — `security` (default), `outdated`, `licenses`, or `all` - `--fix`: Automatically apply safe updates for vulnerable packages ## Execution Execute this dependency audit workflow: ### Step 1: Gather audit data Run the extracted audit script — it detects the package ecosystem, dispatches the matching audit tool, and parses severity / outdated / license-denylist counts into a structured rollup: ```bash bash "${CLAUDE_SKILL_DIR}/scripts/code-dep-audit.sh" --home-dir "$HOME" --project-dir "$(pwd)" ``` Parse `STATUS=` and `ISSUES:` from the output. The script emits `ECOSYSTEM=`, `AUDIT_TOOL=`, `VULN_CRITICAL/HIGH/MEDIUM/LOW`, `OUTDATED_COUNT=`, `LICENSE_ISSUES=`, and an `ISSUES:` block flagging GPL/AGPL licenses (problematic in proprietary projects). When `AUDIT_TOOL_AVAILABLE=false`, the ecosystem's audit tool is missing — run it via the command in `AUDIT_TOOL=` if installed, otherwise suggest `/configure:security`. ### Step 2: Apply fixes (if --fix) For security vulnerabilities: 1. Run `npm audit fix` / `cargo update` / `pip install --upgrade` for safe updates 2. Report which vulnerabilities were fixed and which require manual intervention 3. Run project tests to verify nothing broke ### Step 3: Report results Print summary: ``` Dependency Audit Report ======================= Ecosystem: [JS/TS | Python | Rust | Go] Security: Critical: N High: N Medium: N Low: N Outdated: N packages behind latest License issues: N flagged Top actions: 1. [package@version] - critical CVE-XXXX-XXXX 2. [package] - N major versions behind ``` ## Post-Actions - If many vulnerabilities found → suggest `npm audit fix` or equivalent - If audit tools not configured → suggest `/configure:security` - If outdated packages found → suggest updating in a separate branch ## Agentic Optimizations | Context | Command | |---|---| | Quick JS audit | `npm audit --json` | | Python audit | `pip-audit --format json` | | Rust audit | `cargo audit --json` | | Outdated check | `npm outdated --json` | | License check | `npx license-checker --json --summary` | | CI mode | `npm audit --audit-level=critical --json` |