Goal
Deliver a weekly npm dependency audit summary.
Loop
Kickoff prompt:
/loop 7d Start the "NPM Dependency Audit Weekly" loop.
Goal: deliver a weekly npm dependency audit summary.
Between iterations run: npm outdated || true
Exit when: summary is posted with recommended upgrades.
Step 1: Run npm outdated, categorize updates, and propose a safe upgrade plan.
Run this in the target project:
npm outdated || true
Also run a security audit when the project has a lockfile that makes the result meaningful:
npm audit || true
If there is no package.json, stop and report that the current directory is not an npm project.
Report
Summarize the result with:
- Current package manager evidence, such as
package-lock.json,npm-shrinkwrap.json, or npm scripts. - Outdated dependencies grouped by patch, minor, and major updates.
- Security advisories from
npm audit, grouped by severity, if audit output is available. - Recommended safe upgrade order, starting with low-risk patch and minor updates.
- Breaking-change risks, required code changes, or test coverage gaps for major updates.
- Exact verification commands the project should run after upgrades.
Keep the report direct. Do not apply upgrades unless the user asks you to do the upgrade work.
Guardrails
- Do not modify the check command or exit criteria to force success.
- Do not skip, disable, or bypass checks to make the audit look clean.
- If package metadata is missing, dependency resolution fails, or audit output is blocked by registry/authentication issues, stop and report the blocker.