AI World Information

Dependency & Security Audit

Audits project dependencies for known CVEs and outdated packages, reporting severity and a concrete upgrade path without auto-upgrading.

Reviewed Jul 7, 2026DevOps & Gitby AI World InformationMIT
securitynpmpythondependenciescve

What this skill does

Key features

  • Runs npm audit or pip-audit against the project's lockfile
  • Reports each finding with package, severity, and CVE identifier
  • Gives a concrete upgrade path, including breaking-change warnings
  • Leaves the decision to upgrade with a human — no automatic changes

Use cases

  • Pre-release check for vulnerable dependencies before a deploy
  • Triage a security advisory to see whether the project is affected

SKILL.md

The skill definition — its metadata and the exact instructions an agent follows. Copy it into a SKILL.md file in your agent's skills folder.

namedependency-audit
descriptionAudit project dependencies for known CVEs and outdated packages, reporting severity and upgrade paths without applying changes.
allowed-toolsRead, Grep, Bash(npm audit:*), Bash(pip-audit:*)
outputprioritized vulnerability report
actionread-only

Musts

  • Detect the ecosystem from the lockfile and run the matching auditor: npm audit for Node, pip-audit for Python.
  • Report each vulnerability with the package name, installed version, severity, and CVE or advisory identifier.
  • Give a concrete upgrade path — the target version — and note when it crosses a major version.
  • Separate direct dependencies from transitive ones so the reader knows what they control directly.
  • Do not modify the lockfile or install anything; the audit is read-only.

Guidelines

  • Sort findings by severity so critical and high issues are addressed first.
  • Call out packages that are unmaintained or far behind even when no CVE is filed.
  • When a fix is only available via a transitive dependency, name the direct parent that must bump.
  • Note any finding that has no patched release and suggest a mitigation.
  • Keep the report scannable: one line of summary, then a table of findings.

Output format

## Dependency audit summary
2 critical, 1 high, 3 moderate findings across 4 packages.

| Package    | Installed | Severity | Advisory       | Fixed in | Notes                 |
|------------|-----------|----------|----------------|----------|-----------------------|
| lodash     | 4.17.19   | high     | CVE-2021-23337 | 4.17.21  | direct, safe minor    |
| minimist   | 1.2.0     | critical | CVE-2021-44906 | 1.2.6    | transitive via mkdirp |
| requests   | 2.19.1    | moderate | GHSA-xxxx      | 2.31.0   | major jump, re-test   |

FAQ

Does it upgrade the vulnerable packages for me?
No. It reports findings and the recommended version to move to. A human runs the upgrade and re-tests, since bumps can break the build.
What if a CVE has no fixed version yet?
It flags the finding as unpatched and suggests mitigations such as pinning, removing the dependency, or applying a workaround.

Before running any skill, read its instructions and the tools it's allowed to use, and test it on a safe target first. See LLM security best practices.