---
name: dependency-audit
description: "Audit project dependencies for known CVEs and outdated packages, reporting severity and upgrade paths without applying changes."
allowed-tools: ["Read", "Grep", "Bash(npm audit:*)", "Bash(pip-audit:*)"]
output: "prioritized vulnerability report"
action: "read-only"
---

# Dependency & Security Audit

## Musts

- Detect the ecosystem from the lockfile and run the matching auditor: `npm audit` for Node, `pip-audit` for Python.
- Report each vulnerability with the package name, installed version, severity, and CVE or advisory identifier.
- Give a concrete upgrade path — the target version — and note when it crosses a major version.
- Separate direct dependencies from transitive ones so the reader knows what they control directly.
- Do not modify the lockfile or install anything; the audit is read-only.

## Guidelines

- Sort findings by severity so critical and high issues are addressed first.
- Call out packages that are unmaintained or far behind even when no CVE is filed.
- When a fix is only available via a transitive dependency, name the direct parent that must bump.
- Note any finding that has no patched release and suggest a mitigation.
- Keep the report scannable: one line of summary, then a table of findings.

## Output format

```
## Dependency audit summary
2 critical, 1 high, 3 moderate findings across 4 packages.

| Package    | Installed | Severity | Advisory       | Fixed in | Notes                 |
|------------|-----------|----------|----------------|----------|-----------------------|
| lodash     | 4.17.19   | high     | CVE-2021-23337 | 4.17.21  | direct, safe minor    |
| minimist   | 1.2.0     | critical | CVE-2021-44906 | 1.2.6    | transitive via mkdirp |
| requests   | 2.19.1    | moderate | GHSA-xxxx      | 2.31.0   | major jump, re-test   |
```