# Sec Dependency Audit

> Audit project dependencies for known CVEs and produce a prioritized remediation plan.

- Skill: `matrixx0070/sec-dependency-audit-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add matrixx0070/sec-dependency-audit-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/matrixx0070/sec-dependency-audit-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Matrixx0070 (https://skillmd.com/u/matrixx0070)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/matrixx0070/sec-dependency-audit-2

---


## When to use

Use this before a release, during supply-chain reviews, or on a recurring schedule to catch vulnerable and abandoned packages. It is defensive: you identify and remediate known weaknesses in third-party code.

## METHOD

1. **Inventory dependencies.** Collect direct and transitive packages from lockfiles (package-lock, pnpm-lock, poetry.lock, go.sum). Note versions and whether each is direct or transitive.
2. **Run the ecosystem auditor.** Use the native tool (`npm audit`, `pnpm audit`, `pip-audit`, `osv-scanner`) and read the raw output. Cite counts by severity — do not estimate.
3. **Map CVEs.** For each advisory record the CVE/GHSA id, affected package, vulnerable range, fixed version, and CVSS severity. Distinguish reachable vs. transitive-only.
4. **Assess exploitability.** Note whether the vulnerable code path is actually used and whether a fix exists. Flag packages that are unmaintained or have no patch.
5. **Plan remediation.** For each: upgrade to the fixed version, apply an override/resolution for transitive pins, or document a compensating control if no fix exists.
6. **Prevent drift.** Recommend automated dependency updates and CI audit gating.

## OUTPUT FORMAT

- **Scan summary** — tool used, total advisories by severity (cite output).
- **CVE table** — CVE/GHSA | Package | Current | Fixed | Severity | Direct/Transitive | Action.
- **Remediation plan** — ordered by severity then effort.
- **Residual/no-fix items** — with compensating controls.