Audit deps
The claude code config, tailored to myself, battle-tested (might inspires you)
npx -y skills add latuconsinafr/claude-code-config --skill audit-depsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when you want to audit project dependencies — scans all lockfiles for CVEs, outdated major versions, and license violations. Run before releases or periodically as a health check.
SKILL.md
3.5 KB, 866 tokens by cl100k_base, as published. Nobody here has run it
Dependency Audit
Scan all project dependencies for security vulnerabilities, outdated major versions, and license issues.
Step 1: Detect package managers and lockfiles
Scan the project root and workspaces for all package managers in use:
# Node
ls package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
# Python
ls requirements.txt requirements*.txt Pipfile.lock poetry.lock 2>/dev/null
# Go
ls go.mod go.sum 2>/dev/null
# Rust
ls Cargo.toml Cargo.lock 2>/dev/null
# Ruby
ls Gemfile Gemfile.lock 2>/dev/null
# Monorepo workspaces
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 2>/dev/null
Run all applicable audits. Do not skip a package manager just because it's not the primary one.
Step 2: Security vulnerabilities
Run the native audit tool for each detected package manager:
Node (npm/yarn/pnpm):
npm audit --json 2>/dev/null
# or
yarn audit --json 2>/dev/null
# or
pnpm audit --json 2>/dev/null
Python:
pip-audit --format json 2>/dev/null
# fallback:
safety check --json 2>/dev/null
Go:
govulncheck ./... 2>/dev/null
Rust:
cargo audit --json 2>/dev/null
Ruby:
bundle audit check --update 2>/dev/null
For each vulnerability found, extract:
- Package name and current version
- CVE ID and severity (critical / high / medium / low)
- Affected versions and fixed version
- Whether a fix is available
Step 3: Outdated major versions
Check for packages on outdated major versions (breaking change territory):
Node:
npm outdated --json 2>/dev/null
Filter for packages where current major < latest major (e.g., "3.x.x" → "4.x.x").
Minor/patch outdated packages are noise — only flag major version gaps.
Python:
pip list --outdated --format json 2>/dev/null
Go:
go list -u -m all 2>/dev/null
Step 4: License scan
Check for licenses that may conflict with your project's license or usage:
Node:
npx license-checker --json --production 2>/dev/null
Flag packages with:
- Copyleft licenses (GPL, AGPL, LGPL) in a non-open-source project — may require your code to be open-sourced
- Unknown or unlicensed packages — legal risk
- Licenses requiring attribution (MIT, Apache 2.0 with NOTICE) — ensure compliance
Step 5: Produce prioritized report
🔴 Critical — act immediately
CVEs with critical/high severity that have a fix available.
Format: <package>@<current> → <fixed> | CVE-XXXX-XXXX | <one-line description>
🟡 Should address
- High/medium CVEs without an immediate fix (monitor for patch)
- Major version gaps on core dependencies (framework, ORM, auth library)
- Copyleft license conflicts
🟢 Good to know
- Low severity CVEs
- Minor/patch outdated packages
- Attribution-required licenses (ensure compliance, not a blocker)
✅ Clean
Categories with no findings — call them out explicitly so you know what was checked.
Step 6: Suggested actions
For each 🔴 finding, provide the exact command to fix it:
npm install <package>@<fixed-version>
# or
pip install "<package>>=<fixed-version>"
For major version upgrades, note: "Review changelog for breaking changes before upgrading."
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most audit compliance skills give in 866 tokens
Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07
- Fetch latest guidelines before each reviewin 43 of 937, across 3 files
- Group findings by severityin 43 of 937
- Check files against all fetched rulesin 42 of 937, across 2 files
- Output findings in terse file:line formatin 41 of 937, across 3 files
- Ask user which files to review if none specifiedin 41 of 937, across 3 files
- Read specified files or prompt user for filesin 39 of 937, across 1 file
- Generate the audit reportin 33 of 937, across 30 files
- Assign a severity to every findingin 25 of 937
- Run automated accessibility scansin 23 of 937, across 13 files
- Output a markdown audit reportin 22 of 937
- Map findings to WCAG criteriain 20 of 937, across 10 files
- Confirm audit scopein 19 of 937, across 9 files
Said here and by no other author read
- scan all project dependencies for issues
- extract package name version and vulnerability details
- flag packages on outdated major versions
- flag packages with copyleft or unknown licenses
- note breaking changes for major version upgrades
- call out clean categories explicitly
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.