Dependency Audit Skill

Checks dependencies for security vulnerabilities, outdated versions, and license issues before they cause problems in production.

When to Activate

Activate when:

• Preparing a production release
• Receiving a CVE alert for a dependency
• Adding a major new dependency
• It has been more than 30 days since last audit

Core Principles

• Security over convenience — patch vulnerabilities before releasing
• Patch before releasing — critical and high findings block deployment
• License compliance matters — GPL in a commercial product can create legal problems

Workflow

1. Run security audit commands
2. Triage findings by severity
3. Check for outdated packages
4. Check licenses of key dependencies
5. Produce report with recommended actions

Audit Commands

# npm
npm audit                          # all vulnerabilities
npm audit --audit-level=moderate   # moderate and above
npm audit fix                      # auto-fix safe upgrades
npm audit fix --force              # force fix (may break things — test first)

# Check outdated packages
npm outdated

# Snyk (more comprehensive)
npx snyk test
npx snyk monitor

# Python
pip-audit                          # install: pip install pip-audit
pip list --outdated

# Rust
cargo audit                        # install: cargo install cargo-audit

# Check licenses
npx license-checker --summary
npx license-checker --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC'

Severity Triage

Common Vulnerability Patterns

• Prototype pollution — lodash <4.17.21, merge-deep <3.0.3
• Path traversal — file utility packages that accept user-controlled paths
• ReDoS — regex-based parsers (moment.js, validator.js older versions)
• Command injection — packages that shell out with user-controlled input

Update Strategy

# Safe patch/minor updates
npm update                         # updates within version constraints
npx npm-check-updates -u --target patch  # update only patches

License Audit

Output Format

## Dependency Audit Report

### Vulnerabilities
| Package | Severity | CVE | Fix |
|---------|----------|-----|-----|
| lodash@4.17.19 | High | CVE-2021-23337 | Upgrade to 4.17.21 |

### Outdated Packages (Major Versions)
| Package | Current | Latest | Breaking Changes |
|---------|---------|--------|-----------------|
| express | 4.17.3 | 5.0.0 | Yes — read changelog |

### License Issues
| Package | License | Issue |
|---------|---------|-------|
| some-pkg | GPL-3.0 | Requires legal review for commercial use |

### Verdict: PASS ✅ | FAIL ❌
FAIL if any Critical or High vulnerabilities remain unfixed.