// Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.
Design or review REST and GraphQL API interfaces. Use when asked to design an API, review endpoint structure, define request/response schemas, or improve API ergonomics.
Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
Design, build, or debug data processing pipelines. Use when asked to process a dataset, transform data, build an ETL pipeline, schedule batch jobs, or fix data quality issues.
Safely run database schema migrations. Use when asked to update database schema, add columns, create tables, run alembic, or apply Django migrations.
Execute a structured deployment to staging or production. Use when asked to deploy, ship, release, push to production, or promote to staging.
Write or update technical documentation for code, APIs, or systems. Use when asked to document a module, write a README, generate API docs, or update existing documentation.
| name | dependency-audit |
| description | Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size. |
| license | MIT |
| compatibility | Requires pip or npm/yarn/pnpm |
Identify the package manager. Look for:
requirements.txt / pyproject.toml / Pipfile → Python (pip/uv)package.json → Node.js (npm/yarn/pnpm)go.mod → GoCargo.toml → RustRun vulnerability scan.
pip audit or uvx pip-auditnpm audit or npx better-npm-audit auditgovulncheck ./...Check for outdated packages.
pip list --outdatednpm outdatedLicense audit. Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:
uvx pip-licenses --order=licensenpx license-checker --summaryIdentify unused dependencies.
grep -r "import <package>" src/npx depcheckWrite the report as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).
| Excuse | Rebuttal |
|---|---|
| "We'll update dependencies later" | Known vulnerabilities are actively exploited. Flag them now. |
| "It's a dev dependency, it doesn't matter" | Dev dependencies run in CI and on developer machines — they are attack surface. |
| "Removing unused deps might break something" | If nothing imports it, nothing uses it. Remove it. |