Dependency audit
Audit project dependencies for known vulnerabilities, outdated versions, and license/supply-chain risk. Use when the user asks to audit dependencies, check for CVEs, or update packages safely.From its SKILL.md
npx -y skills add minagayid/Agents --skill dependency-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.5 KB, as published. Nobody here has run it
Dependency Audit
Assess and reduce risk from third-party dependencies.
Steps
- Inventory. Identify manifests and lockfiles (
package-lock.json,pnpm-lock.yaml,poetry.lock,requirements.txt,go.sum,Cargo.lock,pom.xml). - Scan for known vulns with the native tooling:
- npm/pnpm/yarn →
npm audit/pnpm audit - Python →
pip-audit - Go →
govulncheck ./... - Rust →
cargo audit - Multi-eco → OSV-Scanner, Trivy, or GitHub Dependabot alerts
- npm/pnpm/yarn →
- Triage each finding: is the vulnerable code path actually reachable? Severity + exploitability, not just CVSS.
- Remediate highest risk first: bump to a patched version; if none exists, pin/override, apply a workaround, or replace the dependency.
- Check hygiene: unmaintained/abandoned packages, typosquats, license incompatibilities, and needless transitive bloat.
- Verify the app still builds and tests pass after upgrades.
Guidelines
- Prefer the smallest safe bump; read the changelog for breaking changes.
- Commit lockfile changes; keep upgrades reviewable (don't mix with feature work).
- Automate going forward (Dependabot/Renovate) so this doesn't rot.
- Report: package · current → fixed version · severity · reachable? · action taken.