Deps audit

Skill helderberto/agent-skills/skills/deps-audit

Check dependencies for known vulnerabilities and staleness. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for reviewing code quality.From its SKILL.md

Install

npx -y skills add helderberto/agent-skills --skill deps-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 8 commands, including `npm audit` and 7 more.

SKILL.md

2.2 KB, 561 tokens by cl100k_base, as published. Nobody here has run it

Dependency Audit

Detect the project's package manager from its lockfile and run that ecosystem's audit + outdated tooling. Don't assume npm.

Detection

Ecosystem	Lockfile	Audit	Outdated
npm	`package-lock.json`	`npm audit`	`npm outdated`
pnpm	`pnpm-lock.yaml`	`pnpm audit`	`pnpm outdated`
yarn	`yarn.lock`	`yarn npm audit` (berry) / `yarn audit`	`yarn outdated`
Python	`requirements*.txt` / `uv.lock` / `poetry.lock`	`pip-audit`	`pip list --outdated`
Go	`go.sum`	`govulncheck ./...`	`go list -m -u all`
Rust	`Cargo.lock`	`cargo audit`	`cargo outdated`

Workflow

Detect the ecosystem from the lockfile; run audit + outdated (parallel where possible)
Report vulnerabilities with advisory ID + fix command using the severity table below
List outdated packages: table of package/current/latest/type (major vs minor/patch)
Check for obviously unused deps: grep imports in the source dir

Severity Levels

Level	CVSS	Action
Critical	9.0-10.0	Fix immediately, block merge
High	7.0-8.9	Fix before next release
Moderate	4.0-6.9	Fix in current sprint
Low	0.1-3.9	Fix when convenient

For each critical/high vulnerability report:

Package: <name>@<version>
Advisory: <CVE / GHSA / RUSTSEC id>
Severity: Critical
Description: <one line>
Fix: <ecosystem fix command, e.g. npm audit fix / cargo update -p <pkg>>

Rules

Detect the package manager from the lockfile — never assume npm
Prefer the project's own audit task if it defines one
Focus on actionable items
Prioritize: security > major updates > unused > minor updates

Error Handling

Audit tool missing for the ecosystem → report which tool to install (e.g. pip-audit, govulncheck, cargo-audit) and stop
Audit fails for a missing lockfile → generate it (install), then retry
Outdated returns nothing → report all dependencies are current

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most audit compliance skills give in 561 tokens

Counted across 960 of the 1,589 authors here whose files we hold, read 2026-09-06

Read product marketing context before asking questionsin 29 of 960, across 11 files
Rank findings by severityin 29 of 960, across 22 files
Generate audit reportin 22 of 960
Run the audit scriptin 20 of 960, across 19 files
Generate a prioritized action plan reportin 19 of 960, across 11 files
Ensure one H1 per pagein 15 of 960, across 5 files
Ensure sitemap exists and is accessiblein 14 of 960, across 4 files
Verify alt text on all imagesin 12 of 960, across 3 files
Determine the audit scope before startingin 12 of 960, across 4 files
Verify important pages allowed in robots.txtin 11 of 960, across 2 files
Detect business type from homepage signalsin 11 of 960, across 7 files
Delegate specialized tasks to subagentsin 11 of 960, across 7 files

Said here and by no other author read

Detect the package manager from the lockfile
Run audit and outdated tooling
Report vulnerabilities with advisory ID and fix command
List outdated packages in a table
Prefer the project's own audit task
Generate a missing lockfile and retry

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.