dependency-audit

Run the native audit tool for your ecosystem, such as npm audit, composer audit, pip-audit, cargo audit, or govulncheck. The Skill detects the package manager from lock files, executes the matching command, and classifies findings by severity.

Use npm audit fix to apply safe updates automatically, or npm audit fix --force for major version updates that carry more risk. With the --fix flag, the Skill applies these safe fixes and gives manual guidance for ecosystems without auto-fix support.

Python projects use pip-audit or safety check against requirements files, while Rust projects use cargo audit with optional cargo audit fix for automatic remediation. Both produce JSON output that can be parsed into severity-classified reports.

Yes. Go projects are scanned with govulncheck, the official Go vulnerability checker, and Ruby projects use bundle audit from bundler-audit. Neither supports automatic fixes, so the Skill provides manual remediation guidance instead.

A dependency audit scans your entire dependency tree for known vulnerabilities, while CVE research investigates a single named package's vulnerability history in depth. Use the audit for broad project scans and CVE research for deep analysis of one dependency.