<< All versions
Skill v1.0.1
currentAutomated scan100/100sd0xdev/sd0x-dev-flow/dep-audit
+3 new
──Details
PublishedAugust 23, 2026 at 03:34 AM
Content Hashsha256:ca15cd00b1be0afa...
Git SHA5ebaa8e15b16
Bump Typepatch
──Files
Files (1 file, 2.7 KB)
SKILL.md2.7 KBactive
SKILL.md · 101 lines · 2.7 KB
version: "1.0.1" name: dep-audit description: "Audit dependency security risks" allowed-tools: Bash(yarn audit:), Bash(npm audit:), Bash(pnpm audit:), Bash(npx:), Bash(bash:*), Read, Glob
Dependency Audit
Trigger
- Keywords: dep audit, dependency audit, security audit dependencies, dep-audit
When NOT to Use
- OWASP code review (use
/codex-security) - Code review (use
/codex-review-fast) - General security review (use
/codex-security)
Workflow Steps
| Step | Goal | Safety | |
|---|---|---|---|
| audit | Scan dependencies for vulnerabilities | read-only |
Failure behavior: report-all
Task
Arguments
$ARGUMENTS
--level <severity>— Minimum reporting level (low/moderate/high/critical), default: moderate--fix— Attempt automatic fix
Step 1: Check for audit script
Use Glob to check if .claude/scripts/dep-audit.sh exists in the project root.
- Found → run:
bash .claude/scripts/dep-audit.sh $ARGUMENTS - If script succeeds, use its output and skip to the Output section.
- If script fails, treat as a real audit failure (do not silently fallback).
- NOT found → skip to Step 2 (do NOT attempt to run the script).
Step 2: Fallback (no audit script)
Detect the project ecosystem and run the audit manually.
Ecosystem detection (check project root for manifest files):
| Manifest | Ecosystem | Audit Command | Fix Command | |
|---|---|---|---|---|
package.json + pnpm-lock.yaml | Node (pnpm) | pnpm audit --audit-level {LEVEL} | pnpm audit --fix | |
package.json + yarn.lock | Node (yarn) | yarn audit --level {LEVEL} | yarn audit --fix or npx yarn-audit-fix | |
package.json | Node (npm) | npm audit --audit-level={LEVEL} | npm audit fix | |
pyproject.toml | Python | pip-audit or safety check | pip-audit --fix | |
Cargo.toml | Rust | cargo audit | cargo audit fix | |
go.mod | Go | govulncheck ./... | _(manual fix)_ | |
build.gradle | Java | ./gradlew dependencyCheckAnalyze | _(manual fix)_ |
Default {LEVEL} is moderate unless --level argument is provided.
If --fix is specified, run the fix command for the detected ecosystem after audit. If no recognized manifest file exists, report an error.
Output
markdown
## Audit Results| Severity | Count ||----------|-------|| Critical | 0 || High | 0 || Moderate | 0 || Low | 0 |## Vulnerability Details### [severity] Issue Title-**Package**: package-name-**Fix**: Available / Not available## Gate✅ **PASS** — No moderate or above vulnerabilities❌ **FAIL** — Found high severity vulnerabilities
Examples
bash
/dep-audit/dep-audit --level high/dep-audit --fix