User Input
$ARGUMENTS
Audience and tone (interactive mode)
When KISS_AGENT_MODE=interactive (the default), assume the user
has limited technical background and limited domain knowledge
— they may know basics but lack deep expertise in this skill's
area. Run this skill as a guided questionnaire:
- One question at a time. No walls of questions.
- Yes / no first. Phrase so
yes, no, not sure, or skip
is a valid answer.
- Translate jargon, don't strip it. Use the technical term but
always pair it with a plain-English gloss the first time it
appears.
- Choices, not blank fields. When yes/no isn't enough, offer
2-4 lettered options (A/B/C/D) with one-line plain-language
descriptions of the trade-off. Always include "Not sure — pick
a sensible default".
- Always recommend. State the option you would pick and why in
one sentence so the user can reply "yes" / "ok" to accept. Pull
defaults from upstream artefacts (spec, architecture, ADRs,
standards) before asking blank.
- Show, don't ask. When upstream artefacts already imply an
answer, propose it as a pre-filled finding and ask for a
yes / no confirmation rather than asking the user to fill in a
blank.
not sure / skip triggers a sensible default, marked
"(default applied — confirm later)" in the artefact, and a debt
entry in this skill's debt file.
When KISS_AGENT_MODE=auto (or --auto), skip the questionnaire
entirely: apply sensible defaults from upstream artefacts and log
decisions to the parent agent's decision log.
Inputs
.kiss/context.yml- Project lockfiles (package-lock.json, uv.lock, poetry.lock,
go.sum, Cargo.lock, pom.xml, Gemfile.lock, …)
Outputs
{context.paths.docs}/reviews/<feature>/dependencies.md{context.paths.docs}/reviews/<feature>/dependencies.extract
Context Update
Does not mutate .kiss/context.yml.
Handoffs
kiss-security-review Category A06 cites this file.bug-fixer reads Critical / High CVEs to drive fixes.kiss-cicd mirrors the audit as a pipeline stage.
AI authoring scope
Does: enumerate direct + transitive deps from the right
lockfile, fetch current CVE data via WebSearch/WebFetch,
flag licence conflicts against project policy, propose upgrade
paths.
Does not: upgrade packages, edit lockfiles, claim "no
vulnerabilities" without a citation.
Usage
<SKILL_DIR> = the integration's skills root (e.g. .claude/skills/
for Claude Code, .agents/skills/ for Antigravity / Codex,
.cursor/skills/ for Cursor, .windsurf/workflows/ for Windsurf).
Scripts live at <SKILL_DIR>/<skill-name>/scripts/….
bash <SKILL_DIR>/kiss-dependency-audit/scripts/bash/audit.sh --auto
Answer keys
| Key |
Meaning |
Default |
DA_LICENCE_POLICY |
allow-list, comma-separated |
MIT,Apache-2.0,BSD-3-Clause,BSD-2-Clause,ISC |
DA_MAX_AGE_DAYS |
flag deps untouched for this many days |
730 |
1---2name: kiss-dependency-audit3description: Audits third-party dependencies: lists direct + transitive deps, cross-references against CVE databases (via WebSearch/WebFetch), surfaces licence conflicts and abandonware. Records audit as a dated file so subsequent runs show drift. Use when checking for security vulnerabilities in dependencies, performing a licence audit, or reviewing third-party packages for risk.4---567## User Input89```text10$ARGUMENTS11```1213## Audience and tone (interactive mode)1415When `KISS_AGENT_MODE=interactive` (the default), assume the user16has **limited technical background and limited domain knowledge**17— they may know basics but lack deep expertise in this skill's18area. Run this skill as a guided questionnaire:1920- **One question at a time.** No walls of questions.21- **Yes / no first.** Phrase so `yes`, `no`, `not sure`, or `skip`22 is a valid answer.23- **Translate jargon, don't strip it.** Use the technical term but24 always pair it with a plain-English gloss the first time it25 appears.26- **Choices, not blank fields.** When yes/no isn't enough, offer27 2-4 lettered options (A/B/C/D) with one-line plain-language28 descriptions of the trade-off. Always include "Not sure — pick29 a sensible default".30- **Always recommend.** State the option you would pick and why in31 one sentence so the user can reply "yes" / "ok" to accept. Pull32 defaults from upstream artefacts (spec, architecture, ADRs,33 standards) before asking blank.34- **Show, don't ask.** When upstream artefacts already imply an35 answer, propose it as a pre-filled finding and ask for a36 yes / no confirmation rather than asking the user to fill in a37 blank.38- **`not sure` / `skip` triggers a sensible default**, marked39 "(default applied — confirm later)" in the artefact, and a debt40 entry in this skill's debt file.4142When `KISS_AGENT_MODE=auto` (or `--auto`), skip the questionnaire43entirely: apply sensible defaults from upstream artefacts and log44decisions to the parent agent's decision log.4546## Inputs4748- `.kiss/context.yml`49- Project lockfiles (package-lock.json, uv.lock, poetry.lock,50 go.sum, Cargo.lock, pom.xml, Gemfile.lock, …)5152## Outputs5354- `{context.paths.docs}/reviews/<feature>/dependencies.md`55- `{context.paths.docs}/reviews/<feature>/dependencies.extract`5657## Context Update5859Does not mutate `.kiss/context.yml`.6061## Handoffs6263- `kiss-security-review` Category A06 cites this file.64- `bug-fixer` reads Critical / High CVEs to drive fixes.65- `kiss-cicd` mirrors the audit as a pipeline stage.6667## AI authoring scope6869**Does:** enumerate direct + transitive deps from the right70lockfile, fetch current CVE data via `WebSearch`/`WebFetch`,71flag licence conflicts against project policy, propose upgrade72paths.7374**Does not:** upgrade packages, edit lockfiles, claim "no75vulnerabilities" without a citation.7677## Usage7879> `<SKILL_DIR>` = the integration's skills root (e.g. `.claude/skills/`80> for Claude Code, `.agents/skills/` for Antigravity / Codex,81> `.cursor/skills/` for Cursor, `.windsurf/workflows/` for Windsurf).82> Scripts live at `<SKILL_DIR>/<skill-name>/scripts/…`.8384```bash85bash <SKILL_DIR>/kiss-dependency-audit/scripts/bash/audit.sh --auto86```8788### Answer keys8990| Key | Meaning | Default |91|---|---|---|92| `DA_LICENCE_POLICY` | allow-list, comma-separated | `MIT,Apache-2.0,BSD-3-Clause,BSD-2-Clause,ISC` |93| `DA_MAX_AGE_DAYS` | flag deps untouched for this many days | `730` |
dauquangthanh