Weekly Dep Audit

weekly-dep-audit — Cross-Repo Dependency Audit

Uses Gemini 3.1 Pro's 1M context to ingest entire lockfiles + advisory databases and report actionable findings.

Procedure

1. Resolve repos. If repos: is empty, query GitHub for repos the calling user owns with the hermes-audit topic (via github MCP). Otherwise use the provided list.

1. For each repo, pull the relevant lockfile(s):

• package-lock.json / pnpm-lock.yaml / yarn.lock
• uv.lock / poetry.lock / Pipfile.lock / requirements*.txt
• Cargo.lock
• go.sum
• Gemfile.lock

1. Delegate to Gemini 3.1 Pro. Build a single delegate_task call:

```yaml goal: | Audit the following lockfiles for security advisories at severity ${SEVERITY_FLOOR} or higher. Cross-reference against:

• https://osv.dev
• https://github.com/advisories
• https://security.snyk.io

For each finding, output JSON: { repo, ecosystem, package, currentversion, vulnerableranges, advisory_id, severity, cvss, recommendation } context:

• lockfile_dump: |

# repo1/package-lock.json ... # repo2/uv.lock ... toolsets: [web] model: gemini-3.1-pro # 1M context max_iterations: 30 ```

1. Collate findings. Parse the JSON back. Dedupe by advisory_id across repos.

1. Open triage issues. For each finding at severity ≥ severity_floor:

• Check via github MCP if an issue with title [dep-audit] {advisory_id} already exists in the affected repo. Skip if so.
• Otherwise create an issue body containing:
• Advisory link
• Affected versions + current version
• Recommended fix (version bump)
• Suggested PR command (e.g. npm update {package})
• Label with security, dep-audit.

1. Send a summary to the configured notification channel:

``` 📊 Weekly dep-audit 2026-04-17

• 4 repos scanned (1247 packages)
• 3 new CRITICAL, 7 HIGH, 14 MEDIUM
• Opened 10 triage issues

→ https://github.com/issues?q=label:dep-audit+state:open ```

Cron wiring

# ~/.hermes/cron.yaml
- name: weekly-dep-audit
  schedule: "0 9 * * 1"                # Mondays 9am
  task: /weekly-dep-audit severity_floor=high
  notify: telegram_private

Cost note

Gemini 3.1 Pro at $1.50/$12 per MTok ingesting 1M of lockfiles ≈ $1.50 per run. Cheaper than GitHub Advanced Security for small orgs, and catches non-GitHub advisories too.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: OnlyTerp
• Source: OnlyTerp/hermes-optimization-guide
• License: MIT

Install and usage instructions live in the source repository linked above.