How do I install the Audit Deps skill?

Run npx skillmds@latest add latuconsinafr/audit-deps in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Audit Deps safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Audit Deps?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Audit Deps free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Audit Deps?

latuconsinafr (@latuconsinafr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Audit Deps by latuconsinafr — Agent Skill

Name: Audit Deps
Author: latuconsinafr

File contents

Dependency Audit

Scan all project dependencies for security vulnerabilities, outdated major versions, and license issues.

Step 1: Detect package managers and lockfiles

Scan the project root and workspaces for all package managers in use:

# Node
ls package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
# Python
ls requirements.txt requirements*.txt Pipfile.lock poetry.lock 2>/dev/null
# Go
ls go.mod go.sum 2>/dev/null
# Rust
ls Cargo.toml Cargo.lock 2>/dev/null
# Ruby
ls Gemfile Gemfile.lock 2>/dev/null
# Monorepo workspaces
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 2>/dev/null

Run all applicable audits. Do not skip a package manager just because it's not the primary one.

Step 2: Security vulnerabilities

Run the native audit tool for each detected package manager:

Node (npm/yarn/pnpm):

npm audit --json 2>/dev/null
# or
yarn audit --json 2>/dev/null
# or
pnpm audit --json 2>/dev/null

Python:

pip-audit --format json 2>/dev/null
# fallback:
safety check --json 2>/dev/null

Go:

govulncheck ./... 2>/dev/null

Rust:

cargo audit --json 2>/dev/null

Ruby:

bundle audit check --update 2>/dev/null

For each vulnerability found, extract:

Package name and current version
CVE ID and severity (critical / high / medium / low)
Affected versions and fixed version
Whether a fix is available

Step 3: Outdated major versions

Check for packages on outdated major versions (breaking change territory):

Node:

npm outdated --json 2>/dev/null

Filter for packages where current major < latest major (e.g., "3.x.x" → "4.x.x"). Minor/patch outdated packages are noise — only flag major version gaps.

Python:

pip list --outdated --format json 2>/dev/null

Go:

go list -u -m all 2>/dev/null

Step 4: License scan

Check for licenses that may conflict with your project's license or usage:

Node:

npx license-checker --json --production 2>/dev/null

Flag packages with:

Copyleft licenses (GPL, AGPL, LGPL) in a non-open-source project — may require your code to be open-sourced
Unknown or unlicensed packages — legal risk
Licenses requiring attribution (MIT, Apache 2.0 with NOTICE) — ensure compliance

Step 5: Produce prioritized report

🔴 Critical — act immediately

CVEs with critical/high severity that have a fix available. Format: <package>@<current> → <fixed> | CVE-XXXX-XXXX | <one-line description>

🟡 Should address

High/medium CVEs without an immediate fix (monitor for patch)
Major version gaps on core dependencies (framework, ORM, auth library)
Copyleft license conflicts

🟢 Good to know

Low severity CVEs
Minor/patch outdated packages
Attribution-required licenses (ensure compliance, not a blocker)

✅ Clean

Categories with no findings — call them out explicitly so you know what was checked.

Step 6: Suggested actions

For each 🔴 finding, provide the exact command to fix it:

npm install <package>@<fixed-version>
# or
pip install "<package>>=<fixed-version>"

For major version upgrades, note: "Review changelog for breaking changes before upgrading."

---name: audit-depsdescription: Use when you want to audit project dependencies — scans all lockfiles for CVEs, outdated major versions, and license violations. Run before releases or periodically as a health check.---# Dependency AuditScan all project dependencies for security vulnerabilities, outdated major versions, and license issues.## Step 1: Detect package managers and lockfilesScan the project root and workspaces for all package managers in use:```bash# Nodels package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null# Pythonls requirements.txt requirements*.txt Pipfile.lock poetry.lock 2>/dev/null# Gols go.mod go.sum 2>/dev/null# Rustls Cargo.toml Cargo.lock 2>/dev/null# Rubyls Gemfile Gemfile.lock 2>/dev/null# Monorepo workspacesfind . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 2>/dev/null```Run all applicable audits. Do not skip a package manager just because it's not the primary one.## Step 2: Security vulnerabilitiesRun the native audit tool for each detected package manager:**Node (npm/yarn/pnpm):**```bashnpm audit --json 2>/dev/null# oryarn audit --json 2>/dev/null# orpnpm audit --json 2>/dev/null```**Python:**```bashpip-audit --format json 2>/dev/null# fallback:safety check --json 2>/dev/null```**Go:**```bashgovulncheck ./... 2>/dev/null```**Rust:**```bashcargo audit --json 2>/dev/null```**Ruby:**```bashbundle audit check --update 2>/dev/null```For each vulnerability found, extract:- Package name and current version- CVE ID and severity (critical / high / medium / low)- Affected versions and fixed version- Whether a fix is available## Step 3: Outdated major versionsCheck for packages on outdated major versions (breaking change territory):**Node:**```bashnpm outdated --json 2>/dev/null```Filter for packages where `current` major < `latest` major (e.g., `"3.x.x"` → `"4.x.x"`).Minor/patch outdated packages are noise — only flag major version gaps.**Python:**```bashpip list --outdated --format json 2>/dev/null```**Go:**```bashgo list -u -m all 2>/dev/null```## Step 4: License scanCheck for licenses that may conflict with your project's license or usage:**Node:**```bashnpx license-checker --json --production 2>/dev/null```Flag packages with:- **Copyleft licenses** (GPL, AGPL, LGPL) in a non-open-source project — may require your code to be open-sourced- **Unknown or unlicensed** packages — legal risk- **Licenses requiring attribution** (MIT, Apache 2.0 with NOTICE) — ensure compliance## Step 5: Produce prioritized report### 🔴 Critical — act immediatelyCVEs with critical/high severity that have a fix available.Format: `<package>@<current> → <fixed> | CVE-XXXX-XXXX | <one-line description>`### 🟡 Should address- High/medium CVEs without an immediate fix (monitor for patch)- Major version gaps on core dependencies (framework, ORM, auth library)- Copyleft license conflicts### 🟢 Good to know- Low severity CVEs- Minor/patch outdated packages- Attribution-required licenses (ensure compliance, not a blocker)### ✅ CleanCategories with no findings — call them out explicitly so you know what was checked.## Step 6: Suggested actionsFor each 🔴 finding, provide the exact command to fix it:```bashnpm install <package>@<fixed-version># orpip install "<package>>=<fixed-version>"```For major version upgrades, note: "Review changelog for breaking changes before upgrading."

Frequently asked questions

Audit Deps