Dependency Vuln Audit Skill

The problem

Native audit tools like npm audit or cargo audit only report known CVEs, leaving you blind to supply-chain risks like typosquatting or abandoned packages. Manually checking every transitive dependency in a deep tree for these red flags is impossible during a standard PR review.

What it does

• Detects project ecosystems and runs native audit tools (npm, pip, cargo, go, etc.) to fetch known CVEs.
• Analyzes manifest files for supply-chain risks including install scripts, abandoned packages, and typosquatting.
• Normalizes varying severity scales into a unified Critical/High/Medium/Low report.
• Categorizes findings into direct vs. transitive dependencies to clarify the remediation path.
• Generates exact CLI commands for every required version bump or override.

Frameworks & tools

Supports Node.js (npm, yarn, pnpm), Python (pip-audit), Rust (cargo audit), Go (govulncheck), Ruby (bundle audit), and PHP (composer audit).

Why this beats prompting it yourself

General LLMs often hallucinate version numbers or fail to differentiate between a direct dependency you control and a transitive one you don't. This skill executes real environment-aware tools and applies a specific supply-chain heuristic layer that standard prompts miss.

Use cases

• Pre-merge security checks on PRs that modify package-lock.json or requirements.txt.
• Vetting a new package's supply-chain health before adding it to your production stack.
• Generating a unified security report for polyglot repositories with multiple languages.

Known limitations

Requires native audit tools to be installed in the environment. It does not automatically modify lockfiles or run fix commands.