Dependency Audit

Dependency Audit

When to use this skill

Activate when the user wants to:

• Audit npm dependencies for vulnerabilities or outdated versions
• Check license compliance across the dependency tree
• Assess supply chain risk before adding a new dependency

Instructions

1. For vulnerability and staleness checks, run:

   node scripts/audit-packages.mjs <project-directory>
   

2. For license compliance, run:

   node scripts/check-licenses.mjs <project-directory>
   

3. Parse the JSON output from each script
4. Present findings sorted by severity: critical > high > medium > low
5. Suggest specific remediation steps for each issue

Output format

The audit script outputs:

{
  "project": "./my-app",
  "packageManager": "npm",
  "totalDependencies": 42,
  "issues": [
    {
      "package": "lodash",
      "version": "4.17.15",
      "issue": "outdated",
      "severity": "medium",
      "message": "Current: 4.17.15, no repository field in package.json"
    }
  ],
  "summary": { "critical": 0, "high": 0, "medium": 1, "low": 2 }
}

Gotchas

• Only supports npm, yarn, and pnpm (reads package-lock.json, yarn.lock, or pnpm-lock.yaml)
• Does not fetch live vulnerability data from remote APIs — analyzes lock file structure and package metadata locally
• License check walks node_modules/ — run npm install first if modules are missing
• GPL-family licenses are flagged as warnings in MIT/Apache projects, not errors