---
name: 0xjitsu/dep-audit
source: https://app.decimal.ai/s/0xjitsu-dep-audit@1/SKILL.md
source_sha256: a223cfedad7b
---

# Dependency Audit

Scan project dependencies for vulnerabilities, outdated packages, and unused modules.

## When to Trigger

- User asks to audit dependencies or check for vulnerabilities
- User requests a security scan on packages
- User asks "are my dependencies safe?" or "any known CVEs?"
- Before publishing or deploying a new release

## Audit Workflow

### Step 1: Vulnerability Scan

```bash
npm audit --json
```

Parse the JSON output and extract:
- Advisory ID, severity, title
- Vulnerable package name and version range
- Patched version (if available)
- CVSS score and vector
- CWE identifier

### Step 2: Cross-Reference with Sonatype (if MCP available)

Use the Sonatype MCP tool `getRecommendedComponentVersions` for each vulnerable package to get:
- Recommended safe version
- Known malicious versions to avoid
- License risk assessment

### Step 3: Categorize Findings

Group by severity: critical > high > moderate > low.

## Output Format

Present as a markdown table sorted by severity:

```
| # | Severity | Package        | Current | Fixed    | CVSS | Vulnerability              | Fix Command                          |
|---|----------|----------------|---------|----------|------|----------------------------|--------------------------------------|
| 1 | critical | lodash         | 4.17.15 | 4.17.21  | 9.8  | Prototype Pollution (CVE-…)| `npm install lodash@4.17.21`         |
| 2 | high     | axios          | 0.21.0  | 0.21.2   | 7.5  | SSRF via redirect (CVE-…) | `npm install axios@0.21.2`           |
| 3 | moderate | minimatch      | 3.0.4   | 3.0.5    | 5.3  | ReDoS (CVE-…)             | `npm install minimatch@3.0.5`        |
| 4 | low      | debug          | 2.6.8   | 2.6.9    | 3.1  | Regular Expression DoS    | `npm install debug@2.6.9`            |
```

Include a summary line:
```
Found X vulnerabilities: Y critical, Z high, W moderate, V low
```

## Auto-Fix Mode

### Safe fixes (non-breaking — execute without confirmation):

```bash
npm audit fix
```

Report what was fixed and what remains.

### Breaking fixes (requires user confirmation):

```bash
# Only run after explicit user approval
npm audit fix --force
```

Warn the user: "This may upgrade packages to new major versions with breaking changes. Review the changes before proceeding."

## Additional Checks

### Outdated Packages

```bash
npm outdated --json
```

Present as a table:

```
| Package    | Current | Wanted | Latest | Type       |
|------------|---------|--------|--------|------------|
| react      | 18.2.0  | 18.3.1 | 19.1.0 | dependency |
| typescript | 5.3.3   | 5.4.5  | 5.8.2  | devDep     |
```

### Unused Dependencies

If `depcheck` is installed:

```bash
npx depcheck --json
```

List unused dependencies and missing dependencies (imported but not in package.json).

If not installed, check manually by grepping for import/require statements against package.json entries.

## Safety Rules

1. **Never run `npm audit fix --force` without user confirmation** — it can introduce breaking changes
2. **Always show findings before fixing** — let the user review and decide
3. **Preserve lockfile integrity** — if using `package-lock.json` or `bun.lockb`, ensure fixes maintain lock consistency
4. **Flag transitive vulnerabilities** — note when a vulnerability is in a sub-dependency vs direct dependency
5. **Check for monorepo** — if `workspaces` exist in package.json, run audit at root and note which workspace is affected