Dependency Audit Skill

Detect and report known vulnerabilities in your project's dependency tree.

Supports npm, pip (Python), Cargo (Rust), and Go out of the box.

No API keys. No config. Just point it at a project.

Activation

This skill activates when the user mentions:

• "audit", "vulnerability", "CVE", "dependency check", "supply chain", "security scan"
• Checking dependencies, lockfiles, or packages for issues
• Generating an SBOM (Software Bill of Materials)

Example Prompts

1. "Audit this project for vulnerabilities"
2. "Check all my repos in ~/projects for known CVEs"
3. "Are there any critical vulnerabilities I should fix right now?"
4. "Generate an SBOM for this project"
5. "What dependencies need updating in this project?"
6. "Audit only the Python dependencies"

Permissions

permissions:
  exec: true          # Required to run audit CLIs
  read: true          # Read lockfiles
  write: on-request   # SBOM generation writes sbom.cdx.json when user asks
  network: true       # Tools fetch advisory DBs

Agent Workflow

Follow this sequence exactly:

Step 1: Detect

Run the detection script to discover lockfiles and available tools:

bash <skill_dir>/scripts/detect.sh <target_directory>

If no target directory is given, use the current working directory (.).

Parse the JSON output. Note which ecosystems have lockfiles and which tools are available.

Step 2: Audit Each Ecosystem

For each ecosystem detected in Step 1:

• If the audit tool is available, run the corresponding script:

```bash

bash /scripts/audit-npm.sh

bash /scripts/audit-pip.sh

bash /scripts/audit-cargo.sh

bash /scripts/audit-go.sh

```

• If the tool is missing, tell the user which tool is needed and the install command from the detect output. Skip that ecosystem and continue with others.

> Note: yarn.lock and pnpm-lock.yaml are detected as yarn and pnpm ecosystems respectively. Audit support is npm-only in v0.1.x (package-lock.json). If only a yarn.lock or pnpm-lock.yaml is present, inform the user that dedicated yarn/pnpm audit is not yet supported and suggest running yarn audit or pnpm audit manually.

Each script outputs normalized JSON to stdout.

Step 3: Aggregate

Pipe or pass all per-ecosystem JSON results to the aggregator:

bash <skill_dir>/scripts/aggregate.sh <npm_result.json> <pip_result.json> ... 1>unified.json 2>report.md

The aggregator outputs unified JSON to stdout and a Markdown report to stderr.

Capture both: 2>report.md for the Markdown, 1>unified.json for the JSON.

Step 4: Present Results

Show the user the Markdown report from the aggregator. Highlight:

• Total vulnerability count by severity
• Critical and High findings first (these need attention)
• Which ecosystems were scanned vs skipped

If zero vulnerabilities found: report "✅ No known vulnerabilities found."

If no lockfiles found: report "No lockfiles found in

I found these fix commands:
  1. cd /home/user/project && npm audit fix
  2. pip install requests>=2.31.0

I recommend creating a branch first:
  git checkout -b dep-audit-fixes

Shall I run them? (yes/no)

bash <skill_dir>/scripts/sbom.sh <directory>