agentsclimarketplace

Dependency audit

Skill Pratiyush/agent-catalog/skills/skill/dependency-audit

Marketplace for AI Agent Skills, Prompts, Agents, and MCP servers. Powered by @skillscraft.

Install
npx -y skills add Pratiyush/agent-catalog --skill dependency-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit project dependencies for known vulnerabilities, outdated packages, and license compliance issues. Use when the user asks to check dependencies, audit packages, review licenses, or assess supply chain security.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.9 KB, as published. Nobody here has run it

Dependency Audit

When to use this skill

Activate when the user wants to:

  • Audit npm dependencies for vulnerabilities or outdated versions
  • Check license compliance across the dependency tree
  • Assess supply chain risk before adding a new dependency

Instructions

  1. For vulnerability and staleness checks, run: 
    node scripts/audit-packages.mjs <project-directory>
  2. For license compliance, run: 
    node scripts/check-licenses.mjs <project-directory>
  3. Parse the JSON output from each script
  4. Present findings sorted by severity: critical > high > medium > low
  5. Suggest specific remediation steps for each issue

Output format

The audit script outputs:

{
  "project": "./my-app",
  "packageManager": "npm",
  "totalDependencies": 42,
  "issues": [
    {
      "package": "lodash",
      "version": "4.17.15",
      "issue": "outdated",
      "severity": "medium",
      "message": "Current: 4.17.15, no repository field in package.json"
    }
  ],
  "summary": { "critical": 0, "high": 0, "medium": 1, "low": 2 }
}

Gotchas

  • Only supports npm, yarn, and pnpm (reads package-lock.json, yarn.lock, or pnpm-lock.yaml)
  • Does not fetch live vulnerability data from remote APIs — analyzes lock file structure and package metadata locally
  • License check walks node_modules/ — run npm install first if modules are missing
  • GPL-family licenses are flagged as warnings in MIT/Apache projects, not errors

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.