Dependency audit

Skill leek/agent-skills/skills/dependency-audit

Run a weekly dependency audit for Composer or npm projects and propose a safe upgrade plan.From its SKILL.md

Install

npx -y skills add leek/agent-skills --skill dependency-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.2 KB, as published. Nobody here has run it

Dependency Audit Weekly

Goal

Deliver a weekly dependency audit summary for the package manager this project uses.

Detect package manager

Inspect the project root:

composer.json present → Composer (PHP)
package.json present → npm (JavaScript / TypeScript)
Both present → audit both, report each section separately
Neither present → stop and report that the directory is not a Composer or npm project

Loop

Kickoff prompt (harnesses that support scheduled loops):

/loop 7d Start the "Dependency Audit Weekly" loop.
Goal: deliver a weekly dependency audit summary.
Between iterations run the outdated command(s) for the detected manager(s).
Exit when: summary is posted with recommended upgrades.

Composer

composer outdated --direct || true
composer audit || true

npm

npm outdated || true
npm audit || true

Run security audit when a lockfile makes the result meaningful (composer.lock, package-lock.json, or npm-shrinkwrap.json).

Report

Summarize the result with:

Package manager evidence (composer.json / composer.lock, or package.json / lockfile, plus framework hints when relevant)
Outdated direct dependencies grouped by patch, minor, and major updates
Security advisories from the audit command, grouped by severity, when available
Recommended safe upgrade order, starting with low-risk patch and minor updates
Breaking-change risks, required code changes, runtime/framework constraints, or test coverage gaps for major updates
Exact verification commands the project should run after upgrades

Keep the report direct. Do not apply upgrades unless the user asks you to do the upgrade work.

Guardrails

Do not modify the check command or exit criteria to force success.
Do not skip, disable, or bypass checks to make the audit look clean.
If package metadata is missing, dependency resolution fails, or audit output is blocked by registry/authentication issues, stop and report the blocker.