About dependency-audit
dependency-audit is a skill for checking project dependency trees with native package-manager audit tools. It detects the ecosystem from lock files, ranks findings by severity, and supports safe automatic fixes in selected ecosystems.
Key features
- 01Lock-file package-manager detection
- 02Audits across seven ecosystems
- 03Severity-ranked vulnerability reports
- 04Fix version and alternative suggestions
- 05Optional safe auto-fixes
Use cases
- 01Checking a project before release
- 02Reviewing dependency vulnerabilities across ecosystems
- 03Applying supported safe dependency fixes
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/dependency-auditin Claude Code to confirm it loaded.
Details
From the project READMEIt parses each tool's output, classifies findings by severity (CRITICAL/HIGH/MEDIUM/LOW), and suggests fix versions or alternatives. With the --fix flag it applies safe auto-fixes where supported (npm audit fix, cargo audit fix) and gives manual guidance for ecosystems without auto-fix.
Out of scope: researching a single named dependency's CVE history in depth belongs to cve-research.
Dependency Audit Skill
Overview
Run dependency vulnerability checks using native package manager audit tools.
Supported Ecosystems
| Ecosystem | Tool | Auto-fix |
|---|---|---|
| npm/yarn/pnpm/bun | npm audit / yarn audit | Yes |
| PHP/Composer | composer audit | Manual |
| Python/pip | pip-audit / safety check | Manual |
| Rust/Cargo | cargo audit | Yes |
| Go | govulncheck ./... | Manual |
| Swift/CocoaPods | pod audit | Manual |
| Ruby/Bundler | bundle audit | Manual |
Workflow
- Detect package manager from lock files
- Run appropriate audit command
- Parse output for vulnerabilities
- Classify by severity (CRITICAL/HIGH/MEDIUM/LOW)
- Suggest fix versions or alternatives
Auto-Fix Support
When --fix flag is used:
npm audit fixfor safe updatescargo audit fixfor Rust- Manual guidance for other ecosystems