audit-deps · diff

git:20260802.d8a50ff to git:20260910.aac255e

4 added, 0 removed. Audit A to A.

---

name: audit-deps

description: Audit dependencies for vulnerabilities, outdated packages, and license compliance.

disable-model-invocation: false

argument-hint: "[project-path]"

allowed-tools: Bash, Read, Grep, Glob

---

+ ## Writing rule

+ When this skill writes a durable artifact, read .claude/rules/writing-standard.md. Use the controlled technical writing profile.

# /audit-deps — Dependency Audit

Audit project dependencies for security vulnerabilities, outdated packages, and license compliance.

## Usage

```

/audit-deps

/audit-deps path/to/project

```

## What It Checks

### 1. Vulnerability Scan

```bash

npm audit --json

```

| Severity | Action |

|----------|--------|

| Critical | Immediate ticket, block deploys |

| High | Ticket this week |

| Moderate | Ticket this sprint |

| Low | Track in backlog |

### 2. Outdated Packages

```bash

npm outdated --json

```

- Major version behind → review breaking changes

- Minor version behind → schedule update

- Patch behind → update ASAP

### 3. License Compliance

- **Allowed**: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, 0BSD, Unlicense

- **Restricted (require approval)**: GPL-2.0, GPL-3.0, LGPL, AGPL, MPL, CDDL

- **Banned**: UNLICENSED, Unknown, Proprietary

### 4. Dependency Health

- Abandoned packages (no updates > 2 years)

- Low download counts

- No maintainer activity

- Known malicious packages

## Output

Generates a report with:

- Vulnerability summary by severity

- Critical / High vulnerability details with CVE

- Outdated packages list

- License issues

- Recommendations

Optionally creates tickets in the team's tracker for Critical / High vulnerabilities.

Invokes: Dependency Auditor Agent (Guardian)

---

*Part of [ApexYard](https://github.com/me2resh/apexyard) — multi-project SDLC framework for Claude Code · MIT.*