audit-project-dependencies

Audit Project Dependencies

Run one combined dependency audit: scan the project, check for available updates, optionally query OSV.dev for vulnerabilities, and optionally add license categorization — in a single tool call instead of chaining /scan-project-dependencies + /compare-dependency-versions + /dependency-vulnerabilities + /dependency-license by hand.

Steps

1. Call audit_project_dependencies with:

   • projectPath (default: cwd)
   • includeVulnerabilities — default true
   • productionOnly — default true (excludes test-scope dependencies)
   • includeLicenses — default false; set true when the user wants license posture in the same report (adds extra POM/GitHub fetches, so it's opt-in)

2. Present the report:

   • Upgrade table from dependencies[] (current → latest, upgradeType), grouped by source.kind like /check-deps does.
   • Vulnerabilities section for any entry with non-empty vulnerabilities[], sorted by severity; call out malicious: true findings first.
   • When includeLicenses was set, a licenses section (summary.byCategory, uniqueSpdxIds, hasProprietaryOrCopyleft) plus newLicenseCategories — categories that appear exactly once in the scanned set (e.g. one AGPL dependency in an otherwise Apache/MIT tree).
   • Lead with the summary block (total, upgradeable, vulnerable, major, minor, patch) as the headline, details below.

3. Follow the same confirm-before-edit discipline as /check-deps if the user wants updates applied — this skill's job is the combined report, not unattended edits.

Constraints and non-goals

• Not for only checking for updates — /check-deps is narrower and offers to apply them.
• Not for only checking vulnerabilities against a whole project — /check-deps-vulnerabilities.
• Not for a single named dependency outside project context — /check-multiple-versions, /compare-dependency-versions, /dependency-vulnerabilities, or /dependency-license.

Fallback (MCP unavailable only)

Compose the fallbacks of /scan-project-dependencies, /compare-dependency-versions, and /dependency-vulnerabilities (plus /dependency-license when licenses were requested) by hand. State clearly that this loses the single-call dedup (metadata/POM fetches are no longer cached across the three checks).