Dep audit

Skill 0xjitsu/jitsu-skills/skills/dep-audit

Persona-based AI skill ecosystem — 7 personas, 14 orchestration skills for outbound campaigns, publishing, security, macOS automation, and full-stack dev. Works with Claude Code, Claude Chat, and Agent SDK. AGPL v3 + commercial license.

Install

npx -y skills add 0xjitsu/jitsu-skills --skill dep-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audits project dependencies for known vulnerabilities, outdated packages, and unused modules. Triggered when a user asks to check for vulnerabilities, audit dependencies, or run a security scan on installed packages. Produces a severity-sorted findings table with one-liner fix commands and cross-references Sonatype for recommended versions.

The file declares its own license as AGPL-3.0-or-later. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.9 KB, as published. Nobody here has run it

Dependency Audit

Scan project dependencies for vulnerabilities, outdated packages, and unused modules.

When to Trigger

User asks to audit dependencies or check for vulnerabilities
User requests a security scan on packages
User asks "are my dependencies safe?" or "any known CVEs?"
Before publishing or deploying a new release

Audit Workflow

Step 1: Vulnerability Scan

npm audit --json

Parse the JSON output and extract:

Advisory ID, severity, title
Vulnerable package name and version range
Patched version (if available)
CVSS score and vector
CWE identifier

Step 2: Cross-Reference with Sonatype (if MCP available)

Use the Sonatype MCP tool getRecommendedComponentVersions for each vulnerable package to get:

Recommended safe version
Known malicious versions to avoid
License risk assessment

Step 3: Categorize Findings

Group by severity: critical > high > moderate > low.

Output Format

Present as a markdown table sorted by severity:

| # | Severity | Package        | Current | Fixed    | CVSS | Vulnerability              | Fix Command                          |
|---|----------|----------------|---------|----------|------|----------------------------|--------------------------------------|
| 1 | critical | lodash         | 4.17.15 | 4.17.21  | 9.8  | Prototype Pollution (CVE-…)| `npm install [email protected]`         |
| 2 | high     | axios          | 0.21.0  | 0.21.2   | 7.5  | SSRF via redirect (CVE-…) | `npm install [email protected]`           |
| 3 | moderate | minimatch      | 3.0.4   | 3.0.5    | 5.3  | ReDoS (CVE-…)             | `npm install [email protected]`        |
| 4 | low      | debug          | 2.6.8   | 2.6.9    | 3.1  | Regular Expression DoS    | `npm install [email protected]`            |

Include a summary line:

Found X vulnerabilities: Y critical, Z high, W moderate, V low

Auto-Fix Mode

Safe fixes (non-breaking — execute without confirmation):

npm audit fix

Report what was fixed and what remains.

Breaking fixes (requires user confirmation):

# Only run after explicit user approval
npm audit fix --force

Warn the user: "This may upgrade packages to new major versions with breaking changes. Review the changes before proceeding."

Additional Checks

Outdated Packages

npm outdated --json

Present as a table:

| Package    | Current | Wanted | Latest | Type       |
|------------|---------|--------|--------|------------|
| react      | 18.2.0  | 18.3.1 | 19.1.0 | dependency |
| typescript | 5.3.3   | 5.4.5  | 5.8.2  | devDep     |

Unused Dependencies

If depcheck is installed:

npx depcheck --json

List unused dependencies and missing dependencies (imported but not in package.json).

If not installed, check manually by grepping for import/require statements against package.json entries.

Safety Rules

Never run npm audit fix --force without user confirmation — it can introduce breaking changes
Always show findings before fixing — let the user review and decide
Preserve lockfile integrity — if using package-lock.json or bun.lockb, ensure fixes maintain lock consistency
Flag transitive vulnerabilities — note when a vulnerability is in a sub-dependency vs direct dependency
Check for monorepo — if workspaces exist in package.json, run audit at root and note which workspace is affected