audit-installed

name

audit-installed

description

Audit installed packages on a Linux desktop and surface candidates for removal — manually-installed packages that haven't been used recently, orphaned dependencies, large packages, and unused Flatpak / Snap apps. Cross-references package-manager records with binary access times where available. Reports only — does not uninstall. Triggers on "what can I uninstall", "audit installed packages", "find unused programs".

Audit Installed

Reports candidates for cleanup across apt/dpkg, Flatpak, and Snap. The user decides what actually goes.

Sources

1. apt / dpkg (Debian/Ubuntu):
   • Manually-installed: apt-mark showmanual
   • Auto-installed orphans: apt autoremove --dry-run — already a good list of removable cruft.
   • Largest packages: dpkg-query -Wf '${Installed-Size}\t${Package}\n' | sort -nr | head -50 (sizes in KB).
2. Flatpak:
   • flatpak list --app --columns=application,name,size,installation
   • flatpak uninstall --unused --dry-run — surfaces unused runtimes (often big).
3. Snap:
   • snap list plus snap list --all | awk '/disabled/{print $1, $3}' for old disabled revisions (Snap keeps two by default; clean with sudo snap remove --revision=<rev> <name>).
4. Last-used heuristics (best-effort — atime is often disabled):
   • For each manually-installed package, find its binaries with dpkg-query -L <pkg> | grep -E '^/usr/(bin|local/bin|sbin)/' and check stat -c '%X %n' <bin> for atime. If noatime is on, skip this signal entirely and surface that to the user.
   • For Flatpak apps, check the app's data dir mtime (~/.var/app/<app-id>/) — recent activity = recently used.

Suspicious / safe-to-suggest patterns

Suggest for removal:

• Apt orphans from autoremove --dry-run.
• Flatpak unused runtimes from --unused --dry-run.
• Snap old disabled revisions.
• Manually-installed packages whose binaries haven't been atime-touched in >180 days and the user isn't on noatime.
• Multiple browsers / multiple media players / multiple PDF viewers — flag for the user to decide.

Do not suggest for removal:

• Anything in package priority required, important, or standard (dpkg-query -Wf '${Priority}\t${Package}\n').
• Kernels (linux-image-*, linux-headers-*) — separate cleanup tooling.
• Build-essential, drivers, *-dev packages without explicit user consent.
• Anything matching python3-*, lib* — usually pulled in by something else.

Output

Apt:
  Orphaned (autoremove): 14 packages, 312 MiB reclaimable
    sudo apt autoremove

  Top 10 largest installed:
    1.2 GiB  texlive-full
    480 MiB  android-platform-tools
    ...

  Manually installed but unused (atime > 180d):
    inkscape         last used 2024-08-12
    audacity         last used 2024-06-03
    ...

Flatpak:
  Unused runtimes: 4 (1.8 GiB)
    flatpak uninstall --unused

  Apps with no recent data activity (>180d):
    org.kde.krita    ~/.var/app last touched 2024-09-01

Snap:
  Old disabled revisions: 11 (3.4 GiB)
    sudo snap set system refresh.retain=2
    sudo snap remove --revision=<n> <name>   # per snap, see report

Kernel cleanup (separate, run with care):
  3 old kernels installed (~600 MiB). Use `sudo apt autoremove --purge` after verifying current kernel boots cleanly.

Notes

• This skill is report only. No uninstall happens here. Output the exact commands the user can run.
• Don't aggregate sizes across different package systems (apt MiB ≠ flatpak MiB ≠ snap MiB) — install-size accounting differs.
• If mount | grep noatime shows the home filesystem is noatime, skip the atime heuristic entirely and say so.