# Dependency Audit

> Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.

- Skill: `agulli/dependency-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agulli/dependency-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agulli/dependency-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: agulli (https://skillmd.com/u/agulli)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/agulli/dependency-audit

---


## Process

1. **Identify the package manager.** Look for:
   - `requirements.txt` / `pyproject.toml` / `Pipfile` → Python (pip/uv)
   - `package.json` → Node.js (npm/yarn/pnpm)
   - `go.mod` → Go
   - `Cargo.toml` → Rust

2. **Run vulnerability scan.**
   - Python: `pip audit` or `uvx pip-audit`
   - Node.js: `npm audit` or `npx better-npm-audit audit`
   - Go: `govulncheck ./...`

3. **Check for outdated packages.**
   - Python: `pip list --outdated`
   - Node.js: `npm outdated`

4. **License audit.** Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:
   - Python: `uvx pip-licenses --order=license`
   - Node.js: `npx license-checker --summary`

5. **Identify unused dependencies.**
   - Python: Check each import with `grep -r "import <package>" src/`
   - Node.js: `npx depcheck`

6. **Write the report** as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).

## Rationalizations

| Excuse | Rebuttal |
|--------|----------|
| "We'll update dependencies later" | Known vulnerabilities are actively exploited. Flag them now. |
| "It's a dev dependency, it doesn't matter" | Dev dependencies run in CI and on developer machines — they are attack surface. |
| "Removing unused deps might break something" | If nothing imports it, nothing uses it. Remove it. |

## Verification

- [ ] Vulnerability scan was executed (not estimated)
- [ ] Every critical/high vulnerability has a recommended action (update version or replace package)
- [ ] License compatibility was checked against the project's license