# Dep Audit

> >

- **Type:** Skill
- **Install:** `agentstack add skill-cacheforge-ai-cacheforge-skills-dep-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [cacheforge-ai](https://agentstack.voostack.com/s/cacheforge-ai)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [cacheforge-ai](https://github.com/cacheforge-ai)
- **Source:** https://github.com/cacheforge-ai/cacheforge-skills/tree/main/skills/dep-audit
- **Website:** https://clawhub.com

## Install

```sh
agentstack add skill-cacheforge-ai-cacheforge-skills-dep-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Dependency Audit Skill

Detect and report known vulnerabilities in your project's dependency tree.
Supports **npm**, **pip (Python)**, **Cargo (Rust)**, and **Go** out of the box.
No API keys. No config. Just point it at a project.

## Activation

This skill activates when the user mentions:
- "audit", "vulnerability", "CVE", "dependency check", "supply chain", "security scan"
- Checking dependencies, lockfiles, or packages for issues
- Generating an SBOM (Software Bill of Materials)

## Example Prompts

1. "Audit this project for vulnerabilities"
2. "Check all my repos in ~/projects for known CVEs"
3. "Are there any critical vulnerabilities I should fix right now?"
4. "Generate an SBOM for this project"
5. "What dependencies need updating in this project?"
6. "Audit only the Python dependencies"

## Permissions

```yaml
permissions:
  exec: true          # Required to run audit CLIs
  read: true          # Read lockfiles
  write: on-request   # SBOM generation writes sbom.cdx.json when user asks
  network: true       # Tools fetch advisory DBs
```

## Agent Workflow

Follow this sequence exactly:

### Step 1: Detect

Run the detection script to discover lockfiles and available tools:

```bash
bash /scripts/detect.sh 
```

If no target directory is given, use the current working directory (`.`).

Parse the JSON output. Note which ecosystems have lockfiles and which tools are available.

### Step 2: Audit Each Ecosystem

For each ecosystem detected in Step 1:

- **If the audit tool is available**, run the corresponding script:
  ```bash
  bash /scripts/audit-npm.sh 
  bash /scripts/audit-pip.sh 
  bash /scripts/audit-cargo.sh 
  bash /scripts/audit-go.sh 
  ```

- **If the tool is missing**, tell the user which tool is needed and the install command from the detect output. Skip that ecosystem and continue with others.

> **Note:** `yarn.lock` and `pnpm-lock.yaml` are detected as `yarn` and `pnpm` ecosystems respectively. Audit support is npm-only in v0.1.x (`package-lock.json`). If only a `yarn.lock` or `pnpm-lock.yaml` is present, inform the user that dedicated yarn/pnpm audit is not yet supported and suggest running `yarn audit` or `pnpm audit` manually.

Each script outputs normalized JSON to stdout.

### Step 3: Aggregate

Pipe or pass all per-ecosystem JSON results to the aggregator:

```bash
bash /scripts/aggregate.sh   ... 1>unified.json 2>report.md
```

The aggregator outputs unified JSON to **stdout** and a Markdown report to **stderr**.
Capture both: `2>report.md` for the Markdown, `1>unified.json` for the JSON.

### Step 4: Present Results

Show the user the Markdown report from the aggregator. Highlight:
- Total vulnerability count by severity
- Critical and High findings first (these need attention)
- Which ecosystems were scanned vs skipped

If **zero vulnerabilities** found: report "✅ No known vulnerabilities found."
If **no lockfiles** found: report "No lockfiles found in . This skill works with npm, pip, Cargo, and Go projects."

### Discord v2 Delivery Mode (OpenClaw v2026.2.14+)

When the user is in a Discord channel:

- Send a short first response with totals and only Critical/High findings.
- Keep the first message under ~1200 characters and avoid large Markdown tables up front.
- If Discord components are available, include quick actions:
  - `Show Full Report`
  - `Show Fix Commands`
  - `Generate SBOM`
- If components are unavailable, provide the same options as a numbered list.
- Send long details in short chunks (=2.31.0

I recommend creating a branch first:
  git checkout -b dep-audit-fixes

Shall I run them? (yes/no)
```

### Step 6: SBOM (only if user asks)

```bash
bash /scripts/sbom.sh 
```

Report the file location and component count.

## Error Handling

| Situation | Behavior |
|-----------|----------|
| Tool not found | Print which tool is missing + install command. Continue with available tools. |
| Audit tool fails | Capture stderr, report "audit failed for [ecosystem]: [error]". Continue with others. |
| Timeout (>30s per tool) | When `timeout`/`gtimeout` is available, report "audit timed out for [ecosystem], skipping". Continue. |
| Invalid target directory | Report "directory not found or not accessible" and stop that ecosystem scan (do **not** report false "clean"). |
| No lockfiles found | Report "No lockfiles found" + list supported ecosystems. |
| `jq` not available | Detection works without jq. Audit and aggregation **require** jq — install it first. |
| Malformed lockfile | Report parse error for that ecosystem. Continue with others. |

### Aggregation Robustness

- `aggregate.sh` now tolerates mixed inputs (valid results + error objects).
- Invalid input objects are listed under `errors` in unified JSON and rendered in a "Skipped / Error Inputs" Markdown section.
- If no valid ecosystem results are provided, aggregate output sets `status: "error"` instead of crashing.

## Safety

- **Default mode is report-only.** The skill never modifies files unless you explicitly ask for a fix and confirm.
- Audit tools read lockfiles — they do not execute project code.
- Fix commands (`npm audit fix`, `pip install --upgrade`) are printed as suggestions. The agent will ask for confirmation before running them.
- This skill checks known advisory databases (OSV, GitHub Advisory DB, RustSec). It does not detect zero-days or runtime vulnerabilities.
- No data is sent to third-party services beyond what the native audit tools do (they query public advisory databases).
- No telemetry. No tracking. No phone-home.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [cacheforge-ai](https://github.com/cacheforge-ai)
- **Source:** [cacheforge-ai/cacheforge-skills](https://github.com/cacheforge-ai/cacheforge-skills)
- **License:** MIT
- **Homepage:** https://clawhub.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-cacheforge-ai-cacheforge-skills-dep-audit
- Seller: https://agentstack.voostack.com/s/cacheforge-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.