# Dependency Audit

> Audit npm or pip dependencies for outdated packages and known vulnerabilities. Use when checking package health, preparing for a release, reviewing dependencies before merging a PR, or when asked about outdated packages or security advisories.

- **Type:** Skill
- **Install:** `agentstack add skill-davila7-claude-with-skills-well-documented-skill`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [davila7](https://agentstack.voostack.com/s/davila7)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [davila7](https://github.com/davila7)
- **Source:** https://github.com/davila7/claude-with-skills/tree/main/src/content/docs/02-intermediate/lesson-01-frontmatter-reference/examples/well-documented-skill
- **Website:** https://claude-with-skills.vercel.app

## Install

```sh
agentstack add skill-davila7-claude-with-skills-well-documented-skill
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Dependency audit

Run a dependency health check for the current project. If a specific package name was provided as an argument, focus the audit on that package. Otherwise audit all dependencies.

### Step 1: Detect the package manager

Check whether this is a Node.js or Python project:
- If `package.json` exists in the working directory, use npm.
- If `requirements.txt`, `pyproject.toml`, or `setup.py` exists, use pip.
- If both exist, audit both.

### Step 2: Check for outdated packages

For npm:
```
npm outdated
```

For pip:
```
pip list --outdated
```

If `$ARGUMENTS` is a specific package name, filter the output to that package. If `$ARGUMENTS` is empty or "all", show the full list.

### Step 3: Check for known vulnerabilities

For npm:
```
npm audit
```

For pip (if pip-audit is available):
```
pip-audit
```

If pip-audit is not installed, note its absence and recommend installing it: `pip install pip-audit`.

### Step 4: Summarize findings

Present a concise report:

1. Total outdated packages (current version vs latest version for the top 10 most outdated)
2. Any vulnerabilities found: severity level, affected package, advisory ID
3. Recommended actions in priority order: fix critical vulnerabilities first, then high, then update packages with breaking changes separately from patch updates
4. If `$ARGUMENTS` names a specific package: show its current version, latest version, changelog link if available from `npm info  homepage` or `pip show `, and whether any known vulnerabilities affect this specific package

### Notes

- Do not modify `package.json`, `requirements.txt`, or any lock file. This skill audits only; it does not upgrade.
- If the project has no dependencies file at all, report that and stop.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [davila7](https://github.com/davila7)
- **Source:** [davila7/claude-with-skills](https://github.com/davila7/claude-with-skills)
- **License:** MIT
- **Homepage:** https://claude-with-skills.vercel.app

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-davila7-claude-with-skills-well-documented-skill
- Seller: https://agentstack.voostack.com/s/davila7
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.