Dependency Audit
Status: Production Ready Last Updated: 2026-02-03 Scope: npm, pnpm, yarn projects
Commands
| Command | Purpose |
|---|---|
/audit-deps | Run comprehensive dependency audit with prioritised findings |
Quick Start
/audit-deps # Full audit
/audit-deps --security-only # Only security vulnerabilities
/audit-deps --outdated # Only outdated packages
/audit-deps --fix # Auto-fix compatible updatesWhat This Skill Audits
1. Security Vulnerabilities
npm audit / pnpm audit- Critical (CVSS 9.0-10.0): Remote code execution, auth bypass
- High (CVSS 7.0-8.9): Data exposure, privilege escalation
- Moderate (CVSS 4.0-6.9): DoS, info disclosure
- Low (CVSS 0.1-3.9): Minor issues
2. Outdated Packages
npm outdated / pnpm outdatedCategories:
- Major updates: Breaking changes likely (review changelog)
- Minor updates: New features, backwards compatible
- Patch updates: Bug fixes, safe to update
3. License Compliance
Checks for:
- GPL licenses in commercial projects (copyleft risk)
- Unknown/missing licenses
- License conflicts
4. Dependency Health
- Deprecated packages
- Abandoned packages (no updates in 2+ years)
- Packages with open security issues
Output Format
═══════════════════════════════════════════════
DEPENDENCY AUDIT REPORT
═══════════════════════════════════════════════
Project: my-app
Package Manager: pnpm
Total Dependencies: 847 (142 direct, 705 transitive)
───────────────────────────────────────────────
SECURITY
───────────────────────────────────────────────
🔴 CRITICAL (1)
lodash@4.17.20
└─ CVE-2021-23337: Command injection via template()
└─ Fix: npm update lodash@4.17.21
└─ Affects: direct dependency
🟠 HIGH (2)
minimist@1.2.5
└─ CVE-2021-44906: Prototype pollution
└─ Fix: Transitive via mkdirp, update parent
└─ Path: mkdirp → minimist
node-fetch@2.6.1
└─ CVE-2022-0235: Exposure of sensitive headers
└─ Fix: npm update node-fetch@2.6.7
🟡 MODERATE (3)
[details...]
───────────────────────────────────────────────
OUTDATED PACKAGES
───────────────────────────────────────────────
Major Updates (review breaking changes):
react 18.2.0 → 19.1.0 (1 major)
typescript 5.3.0 → 5.8.0 (5 minor)
drizzle-orm 0.44.0 → 0.50.0 (6 minor)
Minor Updates (safe, new features):
@types/node 20.11.0 → 20.14.0
vitest 1.2.0 → 1.6.0
Patch Updates (recommended):
[15 packages with patch updates]
───────────────────────────────────────────────
LICENSE CHECK
───────────────────────────────────────────────
✅ All licenses compatible with MIT
Note: 3 packages use ISC (compatible)
───────────────────────────────────────────────
SUMMARY
───────────────────────────────────────────────
Security Issues: 6 (1 critical, 2 high, 3 moderate)
Outdated: 23 (3 major, 5 minor, 15 patch)
License Issues: 0
Recommended Actions:
1. Fix critical: npm update lodash
2. Fix high: npm audit fix
3. Review major updates before upgrading
═══════════════════════════════════════════════Agent
The dep-auditor agent can:
- Parse npm/pnpm audit JSON output
- Cross-reference CVE databases
- Generate detailed fix recommendations
- Auto-fix safe updates (with confirmation)
CI Integration
GitHub Actions
- name: Audit dependencies
run: npm audit --audit-level=high
continue-on-error: true
- name: Check for critical vulnerabilities
run: |
CRITICAL=$(npm audit --json | jq '.metadata.vulnerabilities.critical')
if [ "$CRITICAL" -gt 0 ]; then
echo "Critical vulnerabilities found!"
exit 1
fiPre-commit Hook
#!/bin/sh
npm audit --audit-level=critical || {
echo "Critical vulnerabilities found. Run 'npm audit fix' or '/audit-deps'"
exit 1
}Package Manager Commands
| Task | npm | pnpm | yarn |
|---|---|---|---|
| Audit | npm audit | pnpm audit | yarn audit |
| Audit JSON | npm audit --json | pnpm audit --json | yarn audit --json |
| Fix auto | npm audit fix | pnpm audit --fix | yarn audit --fix |
| Fix force | npm audit fix --force | N/A | N/A |
| Outdated | npm outdated | pnpm outdated | yarn outdated |
| Why | npm explain <pkg> | pnpm why <pkg> | yarn why <pkg> |
Known Limitations
- npm audit fix --force: May introduce breaking changes (major version bumps)
- Transitive dependencies: Some vulnerabilities require updating parent packages
- False positives: Some advisories may not apply to your usage
- Private registries: May need auth configuration for auditing
Related Skills
- cloudflare-worker-base: For Workers projects
- testing-patterns: Run tests after updates
- developer-toolbox: For commit-helper after fixes
Version: 1.0.0 Last Updated: 2026-02-03