agentsclimarketplace
Sign in

Dependency audit

Skill KhaledSaeed18/dotclaude/skills/security/dependency-audit

Audit a project's dependencies for outdated and vulnerable packages and surface breaking-change notes for upgrades. Works with any ecosystem, including npm/pnpm/yarn, pip/Poetry/uv, Cargo, Go modules, Maven/Gradle, Bundler, Composer, and others. Use when checking a project's dependency health, planning upgrades, or responding to a vulnerability report.From its SKILL.md

Install
npx -y skills add KhaledSaeed18/dotclaude --skill dependency-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.2 KB, 399 tokens by cl100k_base, as published. Nobody here has run it

Audit this project's dependencies for risk and staleness, then recommend a safe upgrade path. Detect the ecosystem before running anything.

Detect the ecosystem

Identify the package manager(s) from the manifests and lockfiles present, then use that ecosystem's native tooling. Common cases:

  • JS/TS: npm audit / pnpm audit / yarn npm audit; npm outdated.
  • Python: pip list --outdated, pip-audit; Poetry/uv equivalents.
  • Rust: cargo outdated, cargo audit.
  • Go: go list -m -u all, govulncheck.
  • Java: mvn versions:display-dependency-updates, OWASP dependency-check; Gradle equivalents.
  • Ruby: bundle outdated, bundle-audit.
  • PHP: composer outdated, composer audit.

If a tool isn't installed, say so and give the exact command to run rather than guessing results. Never invent advisory IDs or version numbers; quote them from real tool output.

Assess

  • Vulnerabilities: list affected package, installed version, fixed version, severity, and advisory ID. Prioritise by severity and by whether the vulnerable code path is actually reachable from this project.
  • Outdated: separate patch/minor (low-risk) from major (potentially breaking).
  • Breaking changes: for the upgrades you recommend, pull the relevant changelog / release notes / migration guide and summarise what would break.

Report

  1. Critical: security fixes to apply now, each with the upgrade command.
  2. Recommended: safe patch/minor bumps.
  3. Needs review: major upgrades, each with its breaking-change summary and a rough effort estimate.
  4. A suggested upgrade order that minimises churn and conflicts.

Keep findings factual and grounded in tool output; quote versions and advisory IDs exactly.

What ships with it: 1 file

978 B alongside SKILL.md

Gives 1 of the 12 instructions most dependency audit skills give in 399 tokens

Counted across 162 of the 192 authors here whose files we hold, read 2026-09-06

  • Verify the gh tool is installed before startingin 10 of 162, across 6 files
  • Find git repositories for all direct dependenciesin 9 of 162, across 5 files
  • Evaluate every dependency against the risk criteriain 9 of 162, across 5 files
  • Normalize repository names to full URLsin 9 of 162, across 5 files
  • Query exact star and issue counts using ghin 9 of 162, across 5 files
  • Ask the user to install gh if missingin 7 of 162, across 3 files
  • Omit low-risk dependencies from the reportin 7 of 162, across 3 files
  • Run the full test suite after each changein 7 of 162
  • Flag dependencies matching any risk criterion with clear reasonsin 6 of 162, across 2 files
  • Commit lockfiles and pin exact dependency versionsin 6 of 162, across 5 files
  • Detect package managers from manifest fileshere, and in 6 of 162
  • Review the changelogs for breaking changesin 5 of 162, across 2 files

Said here and by no other author read

  • Use each ecosystem's native tooling
  • Report missing tools with the exact command to run
  • Prioritise vulnerabilities by severity and reachable code path
  • Separate patch and minor upgrades from major ones
  • Summarise breaking changes from changelogs for recommended upgrades
  • Report critical security fixes with upgrade commands first

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.