dotclaude

Skill in security

dependency-audit

Audit a project's dependencies for outdated and vulnerable packages and surface breaking-change notes for upgrades. Works with any ecosystem, including npm/pnpm/yarn, pip/Poetry/uv, Cargo, Go modules, Maven/Gradle, Bundler, Composer, and others. Use when checking a project's dependency health, planning upgrades, or responding to a vulnerability report.

Arguments
(optional) a specific package, scope, or 'security-only'

Install

As a plugin

Bundled in the security plugin. Add the marketplace once, then install the bundle; it updates with the marketplace.

/plugin marketplace add KhaledSaeed18/dotclaude
/plugin install security@dotclaude

As a single item

Run from the project root; the skill lands under .claude/. Copy it to ~/.claude/ to make it global.

npx shadcn@latest add KhaledSaeed18/dotclaude/dependency-audit

Files installed

  • .claude/skills/dependency-audit/SKILL.md

What it does

Audit this project's dependencies for risk and staleness, then recommend a safe upgrade path. Detect the ecosystem before running anything.

Detect the ecosystem

Identify the package manager(s) from the manifests and lockfiles present, then use that ecosystem's native tooling. Common cases:

  • JS/TS: npm audit / pnpm audit / yarn npm audit; npm outdated.
  • Python: pip list --outdated, pip-audit; Poetry/uv equivalents.
  • Rust: cargo outdated, cargo audit.
  • Go: go list -m -u all, govulncheck.
  • Java: mvn versions:display-dependency-updates, OWASP dependency-check; Gradle equivalents.
  • Ruby: bundle outdated, bundle-audit.
  • PHP: composer outdated, composer audit.

If a tool isn't installed, say so and give the exact command to run rather than guessing results. Never invent advisory IDs or version numbers; quote them from real tool output.

Assess

  • Vulnerabilities: list affected package, installed version, fixed version, severity, and advisory ID. Prioritise by severity and by whether the vulnerable code path is actually reachable from this project.
  • Outdated: separate patch/minor (low-risk) from major (potentially breaking).
  • Breaking changes: for the upgrades you recommend, pull the relevant changelog / release notes / migration guide and summarise what would break.

Report

  1. Critical: security fixes to apply now, each with the upgrade command.
  2. Recommended: safe patch/minor bumps.
  3. Needs review: major upgrades, each with its breaking-change summary and a rough effort estimate.
  4. A suggested upgrade order that minimises churn and conflicts.

Keep findings factual and grounded in tool output; quote versions and advisory IDs exactly.

This is the skill as installed, rendered from its source on GitHub. Read it as Markdown.

  • owasp-securityReview code being written or modified against the OWASP Top 10:2025 and ASVS secure-coding requirements, in any language or stack, catching vulnerability...
  • secret-scanScan code or a diff for hardcoded secrets (API keys, tokens, passwords, private keys, and other exposed credentials) before they get committed or shipped....
  • security-auditorUse this agent when you need a comprehensive security audit of a codebase, module, API surface, or pull request. Covers OWASP Top 10:2025, auth logic...
  • security-auditRun a full-codebase security audit covering OWASP Top 10:2025 vulnerability classes, auth logic, secret handling, input validation, dependency CVEs, and...
  • command-guardA PreToolUse hook that blocks catastrophic Bash commands before they run (recursive force deletes of root or home, fork bombs, writing to raw disk...
  • injection-guardA UserPromptSubmit hook that scans incoming prompts for prompt-injection and jailbreak patterns (instruction overrides, system-prompt extraction attempts...