laurigates/code-dep-audit
code-quality-plugin/skills/code-dep-audit/SKILL.md
Audit dependencies for security vulnerabilities, outdated packages, and license compliance. Use when checking supply chain security, preparing releases, or responding to CVEs.
$ install --global
skillsauthnpx skillsauth add laurigates/claude-plugins code-dep-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 11, 2026, 8:18 AM139.3s3 files scanned
SKILL.md
- name:
- code-dep-audit
- description:
- Audit dependencies for security vulnerabilities, outdated packages, and license compliance. Use when checking supply chain security, preparing releases, or responding to CVEs.
- args:
- [--type <security|outdated|licenses|all>] [--fix]
- argument-hint:
- --type security to check vulnerabilities, --type outdated for updates
- allowed-tools:
- Bash(bash *), Bash(npm audit *), Bash(npx *), Bash(pip-audit *), Bash(cargo audit *), Bash(pip *), Bash(uv *), Bash(cargo *), Read, Grep, Glob, TodoWrite
- created:
- 2026-04-10
- modified:
- 2026-06-10
- reviewed:
- 2026-06-10
/code:dep-audit
Audit project dependencies for vulnerabilities and freshness.
When to Use This Skill
| Use this skill when... | Use something else when... | |---|---| | Checking for known CVEs in dependencies | Setting up security scanning CI → /configure:security | | Preparing a release and need dep health check | Looking for code-level security issues → /code:antipatterns | | Responding to a vulnerability advisory | Reviewing code quality → /code:review | | Auditing license compliance | Configuring dependency management → /configure:package-management |
Context
- Package files: !
find . -maxdepth 1 \( -name "package.json" -o -name "package-lock.json" -o -name "yarn.lock" -o -name "bun.lockb" -o -name "pyproject.toml" -o -name "requirements.txt" -o -name "Cargo.toml" -o -name "Cargo.lock" -o -name "go.mod" -o -name "go.sum" \) -type f
Parameters
--type: Audit type —security(default),outdated,licenses, orall--fix: Automatically apply safe updates for vulnerable packages
Execution
Execute this dependency audit workflow:
Step 1: Gather audit data
Run the extracted audit script — it detects the package ecosystem, dispatches the matching audit tool, and parses severity / outdated / license-denylist counts into a structured rollup:
bash "${CLAUDE_SKILL_DIR}/scripts/code-dep-audit.sh" --home-dir "$HOME" --project-dir "$(pwd)"
Parse STATUS= and ISSUES: from the output. The script emits ECOSYSTEM=, AUDIT_TOOL=, VULN_CRITICAL/HIGH/MEDIUM/LOW, OUTDATED_COUNT=, LICENSE_ISSUES=, and an ISSUES: block flagging GPL/AGPL licenses (problematic in proprietary projects). When AUDIT_TOOL_AVAILABLE=false, the ecosystem's audit tool is missing — run it via the command in AUDIT_TOOL= if installed, otherwise suggest /configure:security.
Step 2: Apply fixes (if --fix)
For security vulnerabilities:
- Run
npm audit fix/cargo update/pip install --upgradefor safe updates - Report which vulnerabilities were fixed and which require manual intervention
- Run project tests to verify nothing broke
Step 3: Report results
Print summary:
Dependency Audit Report
=======================
Ecosystem: [JS/TS | Python | Rust | Go]
Security:
Critical: N
High: N
Medium: N
Low: N
Outdated: N packages behind latest
License issues: N flagged
Top actions:
1. [package@version] - critical CVE-XXXX-XXXX
2. [package] - N major versions behind
Post-Actions
- If many vulnerabilities found → suggest
npm audit fixor equivalent - If audit tools not configured → suggest
/configure:security - If outdated packages found → suggest updating in a separate branch
Agentic Optimizations
| Context | Command |
|---|---|
| Quick JS audit | npm audit --json |
| Python audit | pip-audit --format json |
| Rust audit | cargo audit --json |
| Outdated check | npm outdated --json |
| License check | npx license-checker --json --summary |
| CI mode | npm audit --audit-level=critical --json |
Related Skills
laurigates/quoted-description
development
VerifiedTrustedCommunity
Debug HTTP APIs: trace requests, inspect headers. Use when a request fails: check status first.
46SKILL.mdUpdated Jul 20, 2026
laurigates/folded-description
documentation
VerifiedTrustedCommunity
Render architecture diagrams from text sources. Use when documenting system topology.
46SKILL.mdUpdated Jul 20, 2026
laurigates/adapters/tests/fixtures/mini-marketplace-src/beta-plugin/skilldirs/no-name
tools
VerifiedTrustedCommunity
Inspect JSON payloads and extract nested fields. Use when parsing API responses.
46SKILL.mdUpdated Jul 20, 2026
laurigates/no-description
tools
VerifiedTrustedCommunity
--- name: no-description allowed-tools: Read --- # No Description This skill has no description and must be dropped with a warning.
46SKILL.mdUpdated Jul 20, 2026