me2resh Writing rule
When this skill writes a durable artifact, read .claude/rules/writing-standard.md. Use the controlled technical writing profile.
/audit-deps — Dependency Audit
Audit project dependencies for security vulnerabilities, outdated packages, and license compliance.
Usage
/audit-deps
/audit-deps path/to/project
What It Checks
1. Vulnerability Scan
npm audit --json
| Severity | Action |
|---|---|
| Critical | Immediate ticket, block deploys |
| High | Ticket this week |
| Moderate | Ticket this sprint |
| Low | Track in backlog |
2. Outdated Packages
npm outdated --json
- Major version behind → review breaking changes
- Minor version behind → schedule update
- Patch behind → update ASAP
3. License Compliance
- Allowed: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, 0BSD, Unlicense
- Restricted (require approval): GPL-2.0, GPL-3.0, LGPL, AGPL, MPL, CDDL
- Banned: UNLICENSED, Unknown, Proprietary
4. Dependency Health
- Abandoned packages (no updates > 2 years)
- Low download counts
- No maintainer activity
- Known malicious packages
Output
Generates a report with:
- Vulnerability summary by severity
- Critical / High vulnerability details with CVE
- Outdated packages list
- License issues
- Recommendations
Optionally creates tickets in the team's tracker for Critical / High vulnerabilities.
Invokes: Dependency Auditor Agent (Guardian)
Part of ApexYard — multi-project SDLC framework for Claude Code · MIT.