# Dependency Checker

> Run `npm audit --json` against the target project and summarise high/critical vulnerabilities.

- Skill: `lyupro/dependency-checker` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add lyupro/dependency-checker`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lyupro/dependency-checker/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: lyupro (https://skillmd.com/u/lyupro)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lyupro/dependency-checker

---


This is a script-strategy skill. The script in `scripts/main.sh` runs `npm audit --json` inside the directory supplied via `SKILLFORGE_INPUT` (or the SkillForge temp `cwd` if input is empty), parses the output with `jq`, and prints a one-line summary to stdout.

Output format (one line):

```
high=<N> critical=<M> total=<T> packages=<P>
```

When `npm audit` errors (no `package.json`, no `node_modules`, network failure), the script prints `error=<reason>` and exits 0 — SkillForge returns the line as a successful invocation, the consuming agent decides what to do with the diagnostic.

Prerequisites:

- `config.security.allowScripts: true` in the SkillForge persisted config.
- `npm` and `jq` on the host's resolved `PATH` (on POSIX, the SandboxRunner restricts `PATH` to `/usr/bin:/bin` — install `jq` system-wide or override `DEFAULT_PATH` for this skill).
- `SKILLFORGE_INPUT` set to an absolute path of the project to audit, or unset to audit the temp cwd (which will report no `package.json` — usually pass the path explicitly).