mcpField
D
dependency-audit

dependency-audit

github.com/fusengineSecurity3446 installsUpdated 2w ago
Repository

About dependency-audit

dependency-audit is a security skill that runs native package-manager audit tools across a project's dependency tree. It detects the package manager from lock files, classifies findings by severity, and provides fix guidance, including supported safe auto-fixes.

Key features

  1. 01Detects package manager from lock files
  2. 02Runs ecosystem-specific audit tools
  3. 03Classifies findings by severity
  4. 04Suggests fix versions or alternatives
  5. 05Applies supported fixes with --fix

Use cases

  1. 01Checking project dependencies for vulnerabilities
  2. 02Prioritizing findings and planning remediation
  3. 03Applying supported automatic dependency fixes

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/fusengine/agents --skill dependency-audit

After installing, type/dependency-auditin Claude Code to confirm it loaded.

Bundled filesreferences/audit-commands.mdreferences/templates/audit-report.md

Details

From the project README
This skill runs native package-manager audit tools across a project's full dependency tree, detecting the package manager from lock files and running the matching command: npm/yarn/pnpm/bun audit, composer audit, pip-audit/safety check, cargo audit, govulncheck, pod audit, or bundle audit.

It parses each tool's output, classifies findings by severity (CRITICAL/HIGH/MEDIUM/LOW), and suggests fix versions or alternatives. With the --fix flag it applies safe auto-fixes where supported (npm audit fix, cargo audit fix) and gives manual guidance for ecosystems without auto-fix.

Out of scope: researching a single named dependency's CVE history in depth belongs to cve-research.

Dependency Audit Skill

Overview

Run dependency vulnerability checks using native package manager audit tools.

Supported Ecosystems

EcosystemToolAuto-fix
npm/yarn/pnpm/bunnpm audit / yarn auditYes
PHP/Composercomposer auditManual
Python/pippip-audit / safety checkManual
Rust/Cargocargo auditYes
Gogovulncheck ./...Manual
Swift/CocoaPodspod auditManual
Ruby/Bundlerbundle auditManual

Workflow

  1. Detect package manager from lock files
  2. Run appropriate audit command
  3. Parse output for vulnerabilities
  4. Classify by severity (CRITICAL/HIGH/MEDIUM/LOW)
  5. Suggest fix versions or alternatives

Auto-Fix Support

When --fix flag is used:

  • npm audit fix for safe updates
  • cargo audit fix for Rust
  • Manual guidance for other ecosystems

References

Comments

Markdown supported