dependency-audit

It parses each tool's output, classifies findings by severity (CRITICAL/HIGH/MEDIUM/LOW), and suggests fix versions or alternatives. With the --fix flag it applies safe auto-fixes where supported (npm audit fix, cargo audit fix) and gives manual guidance for ecosystems without auto-fix.

Out of scope: researching a single named dependency's CVE history in depth belongs to cve-research.

Dependency Audit Skill

Overview

Run dependency vulnerability checks using native package manager audit tools.

Supported Ecosystems

Ecosystem	Tool	Auto-fix
npm/yarn/pnpm/bun	npm audit / yarn audit	Yes
PHP/Composer	composer audit	Manual
Python/pip	pip-audit / safety check	Manual
Rust/Cargo	cargo audit	Yes
Go	govulncheck ./...	Manual
Swift/CocoaPods	pod audit	Manual
Ruby/Bundler	bundle audit	Manual

Workflow

1. Detect package manager from lock files
2. Run appropriate audit command
3. Parse output for vulnerabilities
4. Classify by severity (CRITICAL/HIGH/MEDIUM/LOW)
5. Suggest fix versions or alternatives

Auto-Fix Support

When --fix flag is used:

• npm audit fix for safe updates
• cargo audit fix for Rust
• Manual guidance for other ecosystems

References

• Audit Commands
• Report Template