Dependency Cve Audit

---
name: dependency-cve-audit
description: Audit dependency advisories, lockfile integrity, lifecycle scripts, and parser risk.
---

# Dependency CVE Audit

## Trigger Conditions

Use before merging dependency changes or during a periodic supply-chain review.

## Required Inputs

- Package manifest, lockfile, dependency diff, audit availability, and risk-critical packages.

## Workflow

1. Confirm the lockfile exists and matches the manifest.
2. Run the package-manager audit when network access is authorized.
3. Map advisories to production/development reachability and dependency paths.
4. Inspect newly introduced install/prepare lifecycle scripts.
5. Flag wildcard or moving-tag direct dependencies.
6. Review unmaintained parsers that handle untrusted input.

## Deterministic Checks

- Frozen-lockfile check, manifest-range scan, lifecycle-script diff, and audit JSON parse.

## Safety and Permission Boundaries

- Do not install, upgrade, or contact registries unless authorized; report unavailable data.

## Required Evidence

- Package, installed version, advisory identifier, dependency path, fix version, and limitations.

## Completion Condition

- All local checks run and network-dependent checks are passed or explicitly unavailable.

## Example

`Audit ExampleApp dependencies before the release branch is cut.`