Dep Audit

Name: Dep Audit
Author: aibot88

ASecurity

Audit npm dependencies across all package.json files — reports outdated, security issues, and unused packages

4 stars
0 votes
0 copies
3 views
Added September 12, 2026

securitygobashreactnodegitfrontendbackendsecurity

Works with

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 12, 2026

npx -y skills add aibot88/sec_skill_store --skill dep-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Dep Audit?

Add the live security badge to your README. It updates with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/aibot88-dep-audit/badge)](https://www.skillsdirectory.com/skills/aibot88-dep-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
description: Audit npm dependencies across all package.json files — reports outdated, security issues, and unused packages
argument-hint: [--fix] — pass --fix to auto-update safe (patch/minor) upgrades
---

# Dependency Audit

Request: $ARGUMENTS

## Context

- Root package.json: !`cat /Users/danilo/www/vida/package.json | node -p "const p=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"`
- Frontend deps: !`node -p "const p=require('/Users/danilo/www/vida/frontend/package.json'); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"`
- Backend deps: !`node -p "const p=require('/Users/danilo/www/vida/backend/package.json'); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"`

## Your task

### Step 1 — Check for outdated packages

```bash
cd /Users/danilo/www/vida && npm outdated --json 2>/dev/null
cd /Users/danilo/www/vida/frontend && npm outdated --json 2>/dev/null
cd /Users/danilo/www/vida/backend && npm outdated --json 2>/dev/null
```

### Step 2 — Security audit

```bash
cd /Users/danilo/www/vida && npm audit --json 2>/dev/null
cd /Users/danilo/www/vida/frontend && npm audit --json 2>/dev/null
cd /Users/danilo/www/vida/backend && npm audit --json 2>/dev/null
```

### Step 3 — Report

Produce a table grouped by severity:

**Security vulnerabilities:**
| Package | Severity | Vulnerability | Fix available |
|---------|----------|--------------|---------------|
| some-pkg | high | CVE-2024-XXXX | upgrade to 2.1.0 |

**Outdated packages:**
| Package | Location | Current | Wanted | Latest | Type |
|---------|----------|---------|--------|--------|------|
| react | frontend | 18.2.0 | 18.2.0 | 19.1.0 | major |
| vite | frontend | 5.0.0 | 5.4.2 | 6.3.5 | minor→patch |

Categorize each update as:
- `patch` — safe to update immediately
- `minor` — review changelog, likely safe
- `major` — breaking changes, requires careful upgrade

### Step 4 — Auto-fix (if --fix passed)

If $ARGUMENTS contains `--fix`, apply safe patch and minor updates:
```bash
cd /Users/danilo/www/vida/frontend && npm update
cd /Users/danilo/www/vida/backend && npm update
```

Then re-run `npm run check && npm run test` for both to verify nothing broke.

### Step 5 — Summary

```
Security: X critical, X high, X moderate, X low
Outdated: X packages across 3 workspaces
  X patch updates (safe to apply now)
  X minor updates (review changelog)
  X major updates (require planning)
```

For critical/high vulnerabilities, open a GitHub issue using `mcp__github__issue_write` with label `infra`.