Dep Audit

Dependency Security Audit

Quick audit

Run the appropriate command for the detected project type:

| Project type | Command | What it checks | |-------------|---------|---------------| | Python (uv) | uv audit | All deps + extras against OSV database | | Python (frozen) | uv audit --frozen | Audit without updating lock | | JavaScript (bun) | bun audit | Installed packages against npm advisory database | | JavaScript (filtered) | bun audit --audit-level high | Only high/critical severity |

Interpreting results

Python (uv audit)

uv audit checks against the OSV (Open Source Vulnerabilities) database. It reports:

• Package name and installed version
• Vulnerability ID (GHSA-xxxx, PYSEC-xxxx)
• Severity and affected version range
• Whether a fix version is available

To ignore a known/accepted vulnerability: uv audit --ignore GHSA-xxxx-xxxx-xxxx

JavaScript (bun audit)

bun audit checks the npm advisory database. Use --json for machine-readable output.

Transitive dependency analysis

Direct dependencies are only part of the attack surface. Inspect the full tree:

| Task | Python | JavaScript | |------|--------|------------| | Full dependency tree | uv tree | bun pm ls --all | | Why is X installed? | uv tree --package X --invert | bun pm why X | | Direct deps only | uv tree --depth 1 | bun pm ls |

Remediation workflow

1. Audit: uv audit / bun audit
2. Assess each vulnerability:

• Check who depends on it: uv tree --package --invert
• Determine if the vulnerable code path is reachable

1. Upgrade (if fix available):

• uv add == / bun add @
• Run tests after each upgrade

1. Accept risk (if no fix):

• Document with --ignore flag
• Note the rationale in a comment or the session log

1. Record: include all changes in the session log dependency changes section (see /dev-conventions:doc-conventions)

CI integration

Use strict mode that fails the build on any vulnerability:

# Python -- exits non-zero if vulnerabilities found
uv audit --frozen

# JavaScript -- exits non-zero if moderate+ found
bun audit --audit-level moderate

When to audit

• After adding or upgrading any dependency
• Before releases or deployments
• Periodically (weekly or on CI schedule)
• When notified of a new CVE affecting your stack

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fblissjr
• Source: fblissjr/fb-claude-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.