helderberto/deps-audit
deps-audit/SKILL.md
Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for yarn, pnpm, or bun projects (npm only), or for reviewing code quality.
$ install --global
skillsauthnpx skillsauth add helderberto/skills deps-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 30, 2026, 2:40 AM9.0s1 file scanned
SKILL.md
- name:
- deps-audit
- description:
- Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for yarn, pnpm, or bun projects (npm only), or for reviewing code quality.
Dependency Audit
Commands
Run in parallel:
npm auditnpm outdated
Workflow
- Run audit and outdated check in parallel
- Report vulnerabilities with CVE + fix command using severity table below
- List outdated packages: table of package/current/latest/type (major vs minor/patch)
- Check for unused deps: grep imports in
src/
Severity Levels
| Level | CVSS | Action | |---|---|---| | Critical | 9.0-10.0 | Fix immediately, block merge | | High | 7.0-8.9 | Fix before next release | | Moderate | 4.0-6.9 | Fix in current sprint | | Low | 0.1-3.9 | Fix when convenient |
For each critical/high vulnerability report:
Package: <name>@<version>
CVE: CVE-YYYY-XXXXX
Severity: Critical
Description: <one line>
Fix: npm audit fix --force (or: npm install <pkg>@<safe-version>)
Rules
- Never use
npxdirectly - Focus on actionable items
- Prioritize: security > major updates > unused > minor updates
Error Handling
npm auditfails -- runnpm installfirst to generatepackage-lock.json, then retrynpm outdatedreturns nothing -- report all dependencies are currentnpmnot found -- report incompatibility; this skill requires npm
Related Skills
helderberto/caveman
testing
VerifiedTrustedCommunity
Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
10SKILL.mdUpdated May 12, 2026
helderberto/handoff
documentation
VerifiedTrustedCommunity
Compact the current conversation into a handoff doc so a fresh agent can continue the work. Use when user asks to "handoff", "/handoff", "hand this off", or wants to end a session mid-task. Don't use for summarising completed work, writing PRDs/plans/ADRs, or committing changes.
8SKILL.mdUpdated May 20, 2026
helderberto/create-skill
development
VerifiedTrustedCommunity
Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill, or asks "make a skill for X".
8SKILL.mdUpdated May 20, 2026
helderberto/zoom-out
development
VerifiedTrustedCommunity
Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
8SKILL.mdUpdated May 12, 2026