# Deps Audit

> Check dependencies for known vulnerabilities and staleness.

Check dependencies for known vulnerabilities and staleness. Use when asked to "audit dependencies", "check for vulnerabilities", or check dependency health. Don't use for code quality review.

- Page: https://ss33.ai/skills/helderberto/deps-audit-84471208487
- Publisher: helderberto
- Category: [Security](https://ss33.ai/skills/category/security-w9g95g) › [Application security](https://ss33.ai/skills/category/security-w9g95g/application-security-6s8pr9)
- License: MIT
- Source: https://github.com/helderberto/agent-skills/blob/445681fd215e649201f91d65492025f0803efc0a/skills/deps-audit/SKILL.md

## Skill

SKILL.md: https://ss33.ai/api/v1/ss33/download/helderberto/deps-audit-84471208487

# Dependency Audit

Detect the package manager from its lockfile and run that ecosystem's audit + outdated tooling. Prefer the project's own audit task if it defines one. Never assume npm.

| Ecosystem | Lockfile | Audit | Outdated |
|---|---|---|---|
| npm | `package-lock.json` | `npm audit` | `npm outdated` |
| pnpm | `pnpm-lock.yaml` | `pnpm audit` | `pnpm outdated` |
| yarn | `yarn.lock` | `yarn npm audit` (berry) / `yarn audit` | `yarn outdated` |
| Python | `requirements*.txt` / `uv.lock` / `poetry.lock` | `pip-audit` | `pip list --outdated` |
| Go | `go.sum` | `govulncheck ./...` | `go list -m -u all` |
| Rust | `Cargo.lock` | `cargo audit` | `cargo outdated` |

Audit tool missing → say which to install and stop. Lockfile missing → install to generate it, then retry.

## Report

1. Vulnerabilities, critical/high first: package@version, advisory id (CVE/GHSA/RUSTSEC), one line, the ecosystem's fix command.
2. Outdated packages: package / current / latest / major vs minor.
3. Obviously unused deps (grep imports in the source dir).

Action by severity: critical → fix now, blocks merge; high → before next release; moderate → this sprint; low → when convenient. Then major updates > unused > minor.