Dependency Audit

---
name: dependency-audit
description: "Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more."
argument-hint: "[optional: 'security', 'outdated', 'unused', or 'all']"
allowed-tools: Read, Grep, Glob, Bash
---

# Dependency Audit

## Detect Package Manager
!`ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null`
!`ls requirements.txt Pipfile Pipfile.lock pyproject.toml poetry.lock 2>/dev/null`
!`ls go.mod go.sum 2>/dev/null`
!`ls Cargo.toml Cargo.lock 2>/dev/null`
!`ls Gemfile Gemfile.lock 2>/dev/null`
!`ls *.csproj *.sln 2>/dev/null`
!`ls composer.json composer.lock 2>/dev/null`
!`ls mix.exs mix.lock 2>/dev/null`

---

## Audit Checks

### 1. Security Vulnerabilities
Run the appropriate audit command:

| Ecosystem | Command |
|-----------|---------|
| npm | `npm audit --json` |
| yarn | `yarn audit --json` |
| pnpm | `pnpm audit --json` |
| pip | `pip audit 2>/dev/null \|\| pip-audit 2>/dev/null` |
| Go | `govulncheck ./... 2>/dev/null` |
| Rust | `cargo audit 2>/dev/null` |
| Ruby | `bundle audit check 2>/dev/null` |
| .NET | `dotnet list package --vulnerable 2>/dev/null` |
| PHP | `composer audit 2>/dev/null` |

For each vulnerability found:
- Package name and version
- CVE ID or advisory ID
- Severity (Critical/High/Medium/Low)
- Fixed version (if available)
- Whether it's a direct or transitive dependency

### 2. Outdated Dependencies
Run the appropriate command:

| Ecosystem | Command |
|-----------|---------|
| npm | `npm outdated --json` |
| pip | `pip list --outdated 2>/dev/null` |
| Go | `go list -m -u all 2>/dev/null` |
| Rust | `cargo outdated 2>/dev/null` |
| Ruby | `bundle outdated 2>/dev/null` |

Classify updates:
- **Patch** (1.0.0 → 1.0.1): Usually safe, bug fixes
- **Minor** (1.0.0 → 1.1.0): New features, backward compatible
- **Major** (1.0.0 → 2.0.0): Breaking changes, needs review

### 3. Unused Dependencies
Look for dependencies that are imported in package manifest but never referenced in code:

1. Read the dependency list from the manifest
2. For each dependency, search the codebase for imports/requires
3. Flag any dependency with zero references as potentially unused

Note: Some dependencies are used via CLI, plugins, or config — verify before removing.

### 4. License Compliance
Check for problematic licenses:
- **Copyleft** (GPL, AGPL): May require releasing your code
- **Permissive** (MIT, Apache, BSD): Generally safe for commercial use
- **Unknown/No License**: Risk — treat as all rights reserved

---

## Output Format

### Vulnerability Summary
| Package | Version | Severity | CVE | Fix Available |
|---------|---------|----------|-----|---------------|

### Outdated Packages
| Package | Current | Latest | Update Type | Breaking? |
|---------|---------|--------|-------------|-----------|

### Potentially Unused
| Package | Last Import Found | Recommendation |
|---------|-------------------|----------------|

### License Concerns
| Package | License | Risk Level |
|---------|---------|------------|

### Recommendations
1. **Immediate**: Critical/High vulnerabilities with available fixes
2. **Short-term**: Major version updates for key dependencies
3. **Backlog**: Minor updates and cleanup of unused dependencies

### Health Score
Rate dependency health from **0 to 10** (10 = all up to date, no vulns).