---
name: thedaviddias/dependency-audit
source: https://app.decimal.ai/s/thedaviddias-dependency-audit@1/SKILL.md
source_sha256: 71a4dd0af29f
---

# Audit dependencies for known vulnerabilities

Third-party packages are the most common attack surface in modern web applications. The 2021 Log4Shell incident, the 2022 node-ipc supply-chain attack, and countless npm package hijackings demonstrate that a single vulnerable transitive dependency can compromise every application that depends on it. Automated, continuous scanning drastically reduces the window between a CVE being published and your team being aware of it.

## Quick Reference

- Run pnpm audit (or npm audit) before every production deployment
- Integrate automated dependency scanning in CI (GitHub Dependabot or Snyk)
- Treat critical and high severity findings as release blockers
- Pin transitive dependencies with a lock file committed to version control

## Check

Check the project's dependencies for known security vulnerabilities using the package manager audit command.

## Fix

Upgrade, patch, or replace vulnerable dependencies and configure automated scanning in the CI pipeline.

## Explain

Explain how supply-chain attacks work and why dependency auditing is a critical part of modern application security.

## Code Review

Review the lock file and package.json for unpinned version ranges, abandoned packages, and any packages flagged in recent CVE databases.

---

For full implementation details, code examples, and framework-specific guidance,
see `references/rule.md`.

Rule page: https://frontendchecklist.io/en/rules/security/dependency-audit