How do I install the Code Dep Audit skill?

Run npx skillmds@latest add laurigates/code-dep-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Dep Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Dep Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Dep Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Dep Audit?

laurigates (@laurigates) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Dep Audit by laurigates — Agent Skill

Name: Code Dep Audit
Rating: 4.2 (5 reviews)
Author: laurigates

File contents

/code:dep-audit

Audit project dependencies for vulnerabilities and freshness.

When to Use This Skill

Use this skill when...	Use something else when...
Checking for known CVEs in dependencies	Setting up security scanning CI → /configure:security
Preparing a release and need dep health check	Looking for code-level security issues → /code:antipatterns
Responding to a vulnerability advisory	Reviewing code quality → /code:review
Auditing license compliance	Configuring dependency management → /configure:package-management

Context

Package files: !find . -maxdepth 1 $ -name "package.json" -o -name "package-lock.json" -o -name "yarn.lock" -o -name "bun.lock" -o -name "bun.lockb" -o -name "pyproject.toml" -o -name "requirements.txt" -o -name "Cargo.toml" -o -name "Cargo.lock" -o -name "go.mod" -o -name "go.sum" $ -type f

Parameters

--type: Audit type — security (default), outdated, licenses, or all
--fix: Automatically apply safe updates for vulnerable packages

Execution

Execute this dependency audit workflow:

Step 1: Gather audit data

Run the extracted audit script — it detects the package ecosystem, dispatches the matching audit tool, and parses severity / outdated / license-denylist counts into a structured rollup:

bash "${CLAUDE_SKILL_DIR}/scripts/code-dep-audit.sh" --home-dir "$HOME" --project-dir "$(pwd)"

Parse STATUS= and ISSUES: from the output. The script emits ECOSYSTEM=, AUDIT_TOOL=, VULN_CRITICAL/HIGH/MEDIUM/LOW, OUTDATED_COUNT=, LICENSE_ISSUES=, and an ISSUES: block flagging GPL/AGPL licenses (problematic in proprietary projects). When AUDIT_TOOL_AVAILABLE=false, the ecosystem's audit tool is missing — run it via the command in AUDIT_TOOL= if installed, otherwise suggest /configure:security.

Step 2: Apply fixes (if --fix)

For security vulnerabilities:

Run npm audit fix / cargo update / pip install --upgrade for safe updates
Report which vulnerabilities were fixed and which require manual intervention
Run project tests to verify nothing broke

Step 3: Report results

Print summary:

Dependency Audit Report
=======================
Ecosystem: [JS/TS | Python | Rust | Go]

Security:
  Critical: N
  High: N
  Medium: N
  Low: N

Outdated: N packages behind latest
License issues: N flagged

Top actions:
1. [package@version] - critical CVE-XXXX-XXXX
2. [package] - N major versions behind

Post-Actions

If many vulnerabilities found → suggest npm audit fix or equivalent
If audit tools not configured → suggest /configure:security
If outdated packages found → suggest updating in a separate branch

Agentic Optimizations

Context	Command
Quick JS audit	`npm audit --json`
Python audit	`pip-audit --format json`
Rust audit	`cargo audit --json`
Outdated check	`npm outdated --json`
License check	`npx license-checker --json --summary`
CI mode	`npm audit --audit-level=critical --json`

--- name: code-dep-audit description: Audit dependencies for security vulnerabilities, outdated packages, and license compliance. Use when checking supply chain security, preparing releases, or responding to CVEs. args: "[--type <security|outdated|licenses|all>] [--fix]" argument-hint: --type security to check vulnerabilities, --type outdated for updates allowed-tools: Bash(bash *), Bash(npm audit *), Bash(npx *), Bash(pip-audit *), Bash(cargo audit *), Bash(pip *), Bash(uv *), Bash(cargo *), Read, Grep, Glob, TodoWrite created: 2026-04-10 modified: 2026-08-25 reviewed: 2026-06-10 --- # /code:dep-audit Audit project dependencies for vulnerabilities and freshness. ## When to Use This Skill | Use this skill when... | Use something else when... | |---|---| | Checking for known CVEs in dependencies | Setting up security scanning CI → /configure:security | | Preparing a release and need dep health check | Looking for code-level security issues → /code:antipatterns | | Responding to a vulnerability advisory | Reviewing code quality → /code:review | | Auditing license compliance | Configuring dependency management → /configure:package-management | ## Context - Package files: !`find . -maxdepth 1 $ -name "package.json" -o -name "package-lock.json" -o -name "yarn.lock" -o -name "bun.lock" -o -name "bun.lockb" -o -name "pyproject.toml" -o -name "requirements.txt" -o -name "Cargo.toml" -o -name "Cargo.lock" -o -name "go.mod" -o -name "go.sum" $ -type f` ## Parameters - `--type`: Audit type — `security` (default), `outdated`, `licenses`, or `all` - `--fix`: Automatically apply safe updates for vulnerable packages ## Execution Execute this dependency audit workflow: ### Step 1: Gather audit data Run the extracted audit script — it detects the package ecosystem, dispatches the matching audit tool, and parses severity / outdated / license-denylist counts into a structured rollup: ```bash bash "${CLAUDE_SKILL_DIR}/scripts/code-dep-audit.sh" --home-dir "$HOME" --project-dir "$(pwd)" ``` Parse `STATUS=` and `ISSUES:` from the output. The script emits `ECOSYSTEM=`, `AUDIT_TOOL=`, `VULN_CRITICAL/HIGH/MEDIUM/LOW`, `OUTDATED_COUNT=`, `LICENSE_ISSUES=`, and an `ISSUES:` block flagging GPL/AGPL licenses (problematic in proprietary projects). When `AUDIT_TOOL_AVAILABLE=false`, the ecosystem's audit tool is missing — run it via the command in `AUDIT_TOOL=` if installed, otherwise suggest `/configure:security`. ### Step 2: Apply fixes (if --fix) For security vulnerabilities: 1. Run `npm audit fix` / `cargo update` / `pip install --upgrade` for safe updates 2. Report which vulnerabilities were fixed and which require manual intervention 3. Run project tests to verify nothing broke ### Step 3: Report results Print summary: ``` Dependency Audit Report ======================= Ecosystem: [JS/TS | Python | Rust | Go] Security: Critical: N High: N Medium: N Low: N Outdated: N packages behind latest License issues: N flagged Top actions: 1. [package@version] - critical CVE-XXXX-XXXX 2. [package] - N major versions behind ``` ## Post-Actions - If many vulnerabilities found → suggest `npm audit fix` or equivalent - If audit tools not configured → suggest `/configure:security` - If outdated packages found → suggest updating in a separate branch ## Agentic Optimizations | Context | Command | |---|---| | Quick JS audit | `npm audit --json` | | Python audit | `pip-audit --format json` | | Rust audit | `cargo audit --json` | | Outdated check | `npm outdated --json` | | License check | `npx license-checker --json --summary` | | CI mode | `npm audit --audit-level=critical --json` |

Frequently asked questions

Code Dep Audit