agentsclimarketplace
Sign in

Ns audit dependencies

Skill nodesource/nsolid-plugin/skills/ns-audit-dependencies

Audits a local Node.js project dependency tree with NCM vulnerability data. Use when the user asks for an npm audit-style security review, package CVEs, direct/transitive vulnerability report, dependency risk assessment, or remediation plan before upgrading. For vulnerabilities actually loaded in running N|Solid processes, use ns-analyze-vulnerabilities instead.From its SKILL.md

Install
npx -y skills add nodesource/nsolid-plugin --skill ns-audit-dependencies

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.9 KB, as published. Nobody here has run it

Run the audit

If the prompt already contains host-provided audit data, use only that data. Treat it as complete only when it contains renderer-produced Markdown or an equivalent integrity-checked artifact.

Otherwise, run the bundled helper from the project root using the absolute directory containing this SKILL.md:

node "<skill-dir>/audit-dependencies.cjs" --dir "$PWD" --format summary --save-report

The helper requires HTTPS access to api.ncm.nodesource.com and writes the complete report under <project>/.nsolid/assets/. Request escalation scoped to this command when the sandbox blocks either operation. It reports progress and recovery on stderr, saves the complete integrity-checked report itself, and emits a deterministic executive summary with the absolute report link on stdout. Poll the same session until it exits; do not start another audit or use model-driven per-package calls after the helper succeeds.

If the helper reports AUDIT_REPORT_RETRY_REQUIRED, it deliberately saved no report because every package was unchecked solely by retryable transport failures. Request scoped network approval and rerun the exact command once. If the retry returns the same code, report the audit as incomplete and do not retry again.

If the helper reports AUDIT_REPORT_AUTHENTICATION_REQUIRED, it deliberately saved no report. Direct the user to run nsolid-plugin setup --harness <harness> and do not rerun until credentials are configured. For other incomplete results, present the saved report and never describe unchecked packages as safe.

Present the report

Treat successful summary stdout as the complete final chat response. Return it verbatim, preserving its wording, heading order, line breaks, lists, tables, counts, and report link; only the final trailing newline may be omitted. Do not add a preface, conclusion, interpretation, save question, or follow-up offer. Keep progress-only stderr outside the response because its aggregates are already rendered. Treat the linked file—not the chat summary—as the authoritative complete report.

The deterministic summary always uses this section order:

  1. ## Executive Summary
  2. ## Critical Findings
  3. ## Verified Upgrade Actions
  4. ## Findings Requiring Follow-up
  5. ## Withdrawn-Only Findings
  6. ## Coverage Gaps
  7. ## Complete Report

Do not recreate this structure from the saved report or use a model-authored summary template. If successful stdout does not follow this contract, report an output-integrity failure instead of repairing it.

If the helper reports AUDIT_REPORT_INTEGRITY_ERROR or fails to save a publishable report, state that the audit report is incomplete. Do not reconstruct a report from partial output and do not save model-rewritten report text.

When the user asks for details, read the exact linked report and answer from it without rerunning the audit. Rerun only when the user explicitly requests a fresh audit. Never overwrite or replace the saved report.

Guardrails

  • This is a static dependency audit. Use ns-analyze-vulnerabilities separately only when the user asks which findings are loaded in running N|Solid processes.
  • Never invent CVE IDs, severities, fixed versions, or package ownership.
  • ncm-verified means free of active NCM advisories at audit time, not absolutely safe.
  • Never convert a concrete latest-fallback result into @latest.
  • JSON remains available for programmatic callers by omitting --format or using --format json; the complete report remains available on stdout with --format markdown.

Keep looking

Skills are one crate of 626,474. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.