Dependency Audit
Dependency Audit scans your project's installed packages for known vulnerabilities, detects secrets about to be committed, and verifies lockfile integrity. Run it once to report findings, or wire it into CI as a merge gate that blocks risky dependencies from reaching production.
Dependency Audit identifies CVEs in your dependencies and adds a CI gate to prevent vulnerable packages from merging.
AI-generated summary based on this skill's SKILL.md
Install
shipshitdev/skills/dependency-audit · repository language: Python
git clone https://github.com/shipshitdev/skills
cp -r skills ~/.claude/skills/dependency-auditgenerated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
npx skillfed install shipshitdev/skills/dependency-auditFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does Dependency Audit do?
Dependency Audit scans your project's installed packages for known vulnerabilities, detects secrets about to be committed, and verifies lockfile integrity. Run it once to report findings, or wire it into CI as a merge gate that blocks risky dependencies from reaching production.
How do I check dependencies for vulnerabilities with Dependency Audit?
Dependency Audit identifies and audits project dependencies for security vulnerabilities by scanning your codebase against known threat databases. It flags packages with CVEs, outdated versions, and compliance issues, then generates security reports you can review or integrate into your CI/CD pipeline.
Can Dependency Audit find outdated packages?
Yes. Dependency Audit detects outdated or deprecated packages in your codebase and reports their current versions alongside available updates. This helps you prioritize upgrades and maintain a healthy dependency tree.
Does Dependency Audit assess dependency health and compliance?
Dependency Audit assesses dependency health and compliance status by evaluating package versions, lockfile integrity, and security posture. It provides a comprehensive view of your project's supply chain risk and helps you meet compliance requirements.
Can I use Dependency Audit in my CI/CD pipeline?
Yes. Dependency Audit can be wired into CI as a merge gate that blocks risky dependencies from reaching production. Run it once for ad-hoc reporting or integrate it continuously to enforce security standards across your development workflow.
What supply chain risks does Dependency Audit monitor?
Dependency Audit monitors supply chain risks from third-party packages, including known vulnerabilities, deprecated libraries, and suspicious package behavior. It helps you identify and mitigate threats before they impact your application.