# Audit Deps

> Audit dependencies for vulnerabilities, outdated packages, and license compliance.

- Skill: `me2resh/audit-deps` (Agent Skill)
- Install (CLI): `npx skillmds@latest add me2resh/audit-deps`
- Raw SKILL.md: https://api.skillmd.com/api/skills/me2resh/audit-deps/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: me2resh (https://skillmd.com/u/me2resh)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/me2resh/audit-deps

---


## Writing rule

When this skill writes a durable artifact, read .claude/rules/writing-standard.md. Use the controlled technical writing profile.

# /audit-deps — Dependency Audit

Audit project dependencies for security vulnerabilities, outdated packages, and license compliance.

## Usage

```
/audit-deps
/audit-deps path/to/project
```

## What It Checks

### 1. Vulnerability Scan

```bash
npm audit --json
```

| Severity | Action |
|----------|--------|
| Critical | Immediate ticket, block deploys |
| High | Ticket this week |
| Moderate | Ticket this sprint |
| Low | Track in backlog |

### 2. Outdated Packages

```bash
npm outdated --json
```

- Major version behind → review breaking changes
- Minor version behind → schedule update
- Patch behind → update ASAP

### 3. License Compliance

- **Allowed**: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, 0BSD, Unlicense
- **Restricted (require approval)**: GPL-2.0, GPL-3.0, LGPL, AGPL, MPL, CDDL
- **Banned**: UNLICENSED, Unknown, Proprietary

### 4. Dependency Health

- Abandoned packages (no updates > 2 years)
- Low download counts
- No maintainer activity
- Known malicious packages

## Output

Generates a report with:

- Vulnerability summary by severity
- Critical / High vulnerability details with CVE
- Outdated packages list
- License issues
- Recommendations

Optionally creates tickets in the team's tracker for Critical / High vulnerabilities.

Invokes: Dependency Auditor Agent (Guardian)

---

*Part of [ApexYard](https://github.com/me2resh/apexyard) — multi-project SDLC framework for Claude Code · MIT.*