# Weekly Dep Audit

> Audit dependencies across configured repos for security advisories, open triage issues

- Skill: `onlyterp/weekly-dep-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add onlyterp/weekly-dep-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/onlyterp/weekly-dep-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: OnlyTerp (https://skillmd.com/u/onlyterp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/onlyterp/weekly-dep-audit

---


# weekly-dep-audit — Cross-Repo Dependency Audit

Uses Gemini 3.1 Pro's 1M context to ingest entire lockfiles + advisory databases and report actionable findings.

## Procedure

1. **Resolve repos.** If `repos:` is empty, query GitHub for repos the calling user owns with the `hermes-audit` topic (via `github` MCP). Otherwise use the provided list.

2. **For each repo, pull the relevant lockfile(s):**
   - `package-lock.json` / `pnpm-lock.yaml` / `yarn.lock`
   - `uv.lock` / `poetry.lock` / `Pipfile.lock` / `requirements*.txt`
   - `Cargo.lock`
   - `go.sum`
   - `Gemfile.lock`

3. **Delegate to Gemini 3.1 Pro class.** Build a single `delegate_task` call:
   ```yaml
   goal: |
     Audit the following lockfiles for security advisories at severity ${SEVERITY_FLOOR} or higher.
     Cross-reference against:
       - https://osv.dev
       - https://github.com/advisories
       - https://security.snyk.io
     For each finding, output JSON:
       { repo, ecosystem, package, current_version, vulnerable_ranges, advisory_id, severity, cvss, recommendation }
   context:
     - lockfile_dump: |
         # repo1/package-lock.json
         ...
         # repo2/uv.lock
         ...
   toolsets: [web]
   model: gemini-3.1-pro-preview          # 1M context
   max_iterations: 30
   ```

4. **Collate findings.** Parse the JSON back. Dedupe by `advisory_id` across repos.

5. **Open triage issues.** For each finding at severity ≥ `severity_floor`:
   - Check via `github` MCP if an issue with title `[dep-audit] {advisory_id}` already exists in the affected repo. Skip if so.
   - Otherwise create an issue body containing:
     - Advisory link
     - Affected versions + current version
     - Recommended fix (version bump)
     - Suggested PR command (e.g. `npm update {package}`)
   - Label with `security`, `dep-audit`.

6. **Send a summary** to the configured notification channel:
   ```
   📊 Weekly dep-audit 2026-04-17
   - 4 repos scanned (1247 packages)
   - 3 new CRITICAL, 7 HIGH, 14 MEDIUM
   - Opened 10 triage issues
   → https://github.com/issues?q=label:dep-audit+state:open
   ```

## Cron wiring

```bash
hermes cron create "0 9 * * 1" \
  "Run the weekly dependency audit (severity floor high)" \
  --skill weekly-dep-audit --name weekly-dep-audit --deliver telegram
```

## Cost note

Check current list pricing before quoting — as a rough guide, Gemini 3.1
Pro-class ingest of a 1M-token lockfile dump lands around $1.50 at the
$1.50/MTok input tier. Cheaper than GitHub Advanced Security for small
orgs, and it catches non-GitHub advisories too.