Dependency audit
Skill viknesh20-20/claude-code-tool-kit/.claude/skills/dependency-audit
Production-ready Claude Code configuration. 12 original agents, 200+ slash-command skills, 45+ MCP servers, 14 plugins, design + 3D + WebGPU + GSAP + RAG tooling. One-command Node.js installer for premium websites, SaaS apps, AI agents. Free, MIT, stack-agnostic.
npx -y skills add viknesh20-20/claude-code-tool-kit --skill dependency-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more.
SKILL.md
3.4 KB, as published. Nobody here has run it
Dependency Audit
Detect Package Manager
!ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null
!ls requirements.txt Pipfile Pipfile.lock pyproject.toml poetry.lock 2>/dev/null
!ls go.mod go.sum 2>/dev/null
!ls Cargo.toml Cargo.lock 2>/dev/null
!ls Gemfile Gemfile.lock 2>/dev/null
!ls *.csproj *.sln 2>/dev/null
!ls composer.json composer.lock 2>/dev/null
!ls mix.exs mix.lock 2>/dev/null
Audit Checks
1. Security Vulnerabilities
Run the appropriate audit command:
| Ecosystem | Command |
|---|---|
| npm | npm audit --json |
| yarn | yarn audit --json |
| pnpm | pnpm audit --json |
| pip | pip audit 2>/dev/null || pip-audit 2>/dev/null |
| Go | govulncheck ./... 2>/dev/null |
| Rust | cargo audit 2>/dev/null |
| Ruby | bundle audit check 2>/dev/null |
| .NET | dotnet list package --vulnerable 2>/dev/null |
| PHP | composer audit 2>/dev/null |
For each vulnerability found:
- Package name and version
- CVE ID or advisory ID
- Severity (Critical/High/Medium/Low)
- Fixed version (if available)
- Whether it's a direct or transitive dependency
2. Outdated Dependencies
Run the appropriate command:
| Ecosystem | Command |
|---|---|
| npm | npm outdated --json |
| pip | pip list --outdated 2>/dev/null |
| Go | go list -m -u all 2>/dev/null |
| Rust | cargo outdated 2>/dev/null |
| Ruby | bundle outdated 2>/dev/null |
Classify updates:
- Patch (1.0.0 → 1.0.1): Usually safe, bug fixes
- Minor (1.0.0 → 1.1.0): New features, backward compatible
- Major (1.0.0 → 2.0.0): Breaking changes, needs review
3. Unused Dependencies
Look for dependencies that are imported in package manifest but never referenced in code:
- Read the dependency list from the manifest
- For each dependency, search the codebase for imports/requires
- Flag any dependency with zero references as potentially unused
Note: Some dependencies are used via CLI, plugins, or config — verify before removing.
4. License Compliance
Check for problematic licenses:
- Copyleft (GPL, AGPL): May require releasing your code
- Permissive (MIT, Apache, BSD): Generally safe for commercial use
- Unknown/No License: Risk — treat as all rights reserved
Output Format
Vulnerability Summary
| Package | Version | Severity | CVE | Fix Available |
|---|
Outdated Packages
| Package | Current | Latest | Update Type | Breaking? |
|---|
Potentially Unused
| Package | Last Import Found | Recommendation |
|---|
License Concerns
| Package | License | Risk Level |
|---|
Recommendations
- Immediate: Critical/High vulnerabilities with available fixes
- Short-term: Major version updates for key dependencies
- Backlog: Minor updates and cleanup of unused dependencies
Health Score
Rate dependency health from 0 to 10 (10 = all up to date, no vulns).