From dependency-audit
Audits project dependencies across package.json, requirements.txt, go.mod, and Gemfile for unpinned versions, deprecated packages, missing lockfiles, and known CVEs.
npx claudepluginhub realdougeubanks/claudemarketplace --plugin dependency-audit/dependency-auditAudits project dependencies for security vulnerabilities, outdated versions, licenses, maintenance, performance, conflicts, and supply chain risks; outputs health report and update plan.
/dependency-auditAudits project dependencies for security vulnerabilities, outdated versions, licenses, maintenance, performance, conflicts, and supply chain risks; outputs health report and update plan.
/dependency-auditAudits project dependencies for vulnerabilities and outdated packages using native tools, categorizes by severity, and generates prioritized upgrade plans with formatted reports.
/dependency-auditAudits project dependencies for security vulnerabilities, license compliance, outdated packages, bundle size, and performance issues, producing analysis reports and recommendations.
/dependency-auditAudits project dependencies for vulnerabilities and outdated packages using native tools, categorizes by severity, and generates prioritized upgrade plans with formatted reports.
Audit project dependencies for staleness, vulnerabilities, and hygiene issues across multiple package ecosystems.
Invoke as /dependency-audit for a report only, or /dependency-audit --fix to also apply safe upgrades.
When invoked via /dependency-audit:
Use Glob to detect package manifests in the project root and subdirectories:
package.jsonrequirements.txtPipfilepyproject.tomlgo.modGemfilecomposer.jsonProcess all manifests that exist. If none are found, report that no supported manifests were detected and exit.
For each manifest found, use Read to parse its contents and apply the following checks:
*, latest, or ranges like ^x.x.x or ~x.x.x that allow major/minor drift.dependencies block (production runtime contamination).request — deprecated; recommend node-fetch or axiosmoment — large bundle size; recommend date-fns or dayjslodash — tree-shaking concerns; recommend per-method imports or native alternativesuuid v3 or earlier — insecure random; recommend v4 or v7== version pin).imp — removed in Python 3.12; use importlibdistutils — deprecated in Python 3.10, removed in 3.12; use setuptoolsoptparse — deprecated; use argparsereplace directives pointing to local filesystem paths (dangerous in production).source specified.* or @dev version constraints.Use Glob to check for the following lockfiles:
package-lock.jsonyarn.lockpnpm-lock.yamlpoetry.lockPipfile.lockgo.sumGemfile.lockFor each manifest found without a corresponding lockfile, flag it as MISSING LOCKFILE.
Use Bash to run the appropriate audit command if the corresponding manifest exists. Capture output and parse for HIGH and CRITICAL severity findings.
package.json exists):
npm audit --json 2>/dev/null
requirements.txt or Pipfile exists):
pip-audit --format json 2>/dev/null
Skip gracefully if pip-audit is not installed — note in the report that pip-audit was not available.go.mod exists):
go list -m -json all 2>/dev/null
Include any HIGH or CRITICAL CVEs found in the report findings.
Produce a Dependency Audit Report in this format:
## Dependency Audit — <project name> — <date>
### Summary
| Category | Count |
|----------|-------|
| Unpinned versions | X |
| Missing lockfiles | X |
| Deprecated packages | X |
| Known CVEs (HIGH+) | X |
### Findings
**[CRITICAL] <package>@<version> — <CVE or issue description>**
- Manifest: <filename>
- Current: <version> | Fix: <fix version or action>
- Recommendation: `<upgrade command>`
**[HIGH] ...**
**[MEDIUM] ...**
**[INFO] ...**
### Upgrade Commands
\`\`\`bash
<aggregated upgrade commands>
\`\`\`
Severity tiers:
replace directivesIf no issues are found, report a clean bill of health and recommend running audits on a recurring schedule.
After producing the report, ask the user:
"Would you like me to apply safe upgrades automatically? I'll upgrade patch and minor versions (non-breaking) and run your test suite to verify nothing broke."
If the user agrees:
Determine the package manager from the manifest files found in Step 1 (npm/yarn/pnpm, pip, go, bundler).
For each package flagged as outdated (NOT CVE-critical — those require manual review), run the appropriate upgrade command:
npm update --save for minor/patch (does not cross major versions)pip install --upgrade <package>==<safe-version> for each package individuallygo get <module>@latest for each indirect dependencybundle update --conservative (stays within Gemfile constraints)After upgrading, detect and run the test suite:
npm test if defined in package.json scriptspytest or python -m pytest if pytest is installedgo test ./...bundle exec rspec or bundle exec rake testIf tests pass: summarize what was upgraded and confirm. Write a brief upgrade summary to docs/dependency-upgrades-<date>.md.
If tests fail: immediately revert the upgrades (git checkout -- package*.json etc.), report which package likely caused the failure, and recommend upgrading that package manually after reading its changelog.
CVE-critical findings are always excluded from auto-fix — report them separately with a note that they require manual review and testing.