/deps-audit - Dependency Audit

Audit project dependencies for security vulnerabilities and updates.

Usage

/deps-audit [scope]

Arguments:

• scope - (optional) Audit scope: security, outdated, licenses, all

Examples

/deps-audit
/deps-audit security
/deps-audit outdated
/deps-audit licenses
/deps-audit all

What It Does

1. Analyzes dependencies for:

   • Security: Known vulnerabilities (CVEs)
   • Updates: Outdated packages with available updates
   • Licenses: License compatibility issues
   • Unused: Dependencies that may not be needed

2. For vulnerabilities provides:

   • Severity level (critical, high, medium, low)
   • CVE identifier
   • Affected versions
   • Patched version (if available)
   • Remediation steps

Output Format

## Dependency Audit

### Security Vulnerabilities

#### Critical ({count})

| Package | Version | Vulnerability | Fix |
|---------|---------|---------------|-----|
| {pkg} | {ver} | {CVE-XXXX} | Upgrade to {ver} |

**Details:**
- **CVE-XXXX:** {description}
  - Severity: Critical
  - CVSS: {score}
  - Affected: {version range}
  - Fix: `npm update {package}` or `yarn upgrade {package}`

#### High ({count})
{Similar format}

### Outdated Packages

| Package | Current | Latest | Type |
|---------|---------|--------|------|
| {pkg} | {current} | {latest} | {major/minor/patch} |

### License Issues
| Package | License | Issue |
|---------|---------|-------|
| {pkg} | {license} | {compatibility concern} |

### Recommendations
1. **Immediate:** {critical fixes}
2. **Soon:** {high priority updates}
3. **Planned:** {routine updates}

### Summary
- Total dependencies: {count}
- Vulnerabilities: {count} ({critical} critical)
- Outdated: {count}
- License issues: {count}

Skill Used

skills/security/dependency-audit/

When to Use Agent Instead

Use the DevOps Engineer agent when:

• CI/CD integration for automated audits
• Creating update policies
• Managing breaking changes from updates