skills.rest
nodesource
nodesourceOFFICIAL
Explore all skills by this author →
Website𝕏@NodeSourceGitHub

ns-audit-dependencies

Audits Node.js project dependency trees against NCM vulnerability data and generates verified remediation reports.

6|7|Updated Jun 4, 2026
Search Tags:#remediation#nodejs#dependency audit#vulnerability scanning#cve#lockfile#ncm
One-click install
npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-audit-dependencies-nodesource
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ns-audit-dependencies
Source: https://github.com/nodesource/nsolid-plugin/tree/main/skills/ns-audit-dependencies
Command: npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-audit-dependencies-nodesource

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Node.js projects accumulate direct and transitive dependencies with known CVEs, but raw npm audit output lacks verified upgrade targets and coverage accounting. This Skill audits the full dependency tree against NodeSource NCM vulnerability data and produces an integrity-checked report with NCM-verified remediation versions. ## Core Features & Use Cases - Full dependency tree audit: Parses package-lock.json, yarn.lock, or pnpm-lock.yaml to collect direct and transitive dependencies, then checks every package version against the NCM API. - Verified remediation plan: Queries patched-range boundary and latest candidate versions to confirm upgrade targets free of active advisories, distinguishing verified, unresolved, and verification-failed findings. - Integrity-checked reporting: Saves a complete Markdown report under .nsolid/assets/ and emits a deterministic executive summary with severity counts, coverage gaps, and withdrawn-only findings. - Use Case: Before a dependency upgrade sprint, run the audit to get a severity-ranked list of vulnerable packages with NCM-verified target versions and a remediation table, instead of manually cross-referencing CVE databases. ## Quick Start Ask the assistant to audit this project's dependencies for vulnerabilities using the NCM audit skill and show the executive summary.

Frequently Asked Questions about ns-audit-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Node.js dependencies for vulnerabilities?▼

Run the bundled audit helper from the project root, which collects dependencies from your lockfile and checks each package version against the NCM API. It saves a complete report under .nsolid/assets/ and prints an executive summary with severity counts and verified upgrade targets.

What is the difference between this audit and npm audit?▼

This audit uses NodeSource NCM vulnerability data and verifies remediation candidates by querying patched-range boundaries and latest versions, confirming targets are free of active advisories. It also tracks unchecked packages, withdrawn advisories, and batch recovery statistics that npm audit does not report.

Does the dependency audit support yarn and pnpm lockfiles?▼

Yes, the collector parses package-lock.json v2/v3, yarn.lock classic, and pnpm-lock.yaml v5/v6/v9. It respects the packageManager field in package.json and falls back to whichever lockfile exists, or to package.json direct dependencies when no lockfile is present.

Why does the audit report AUDIT_REPORT_AUTHENTICATION_REQUIRED?▼

This code means every package was unchecked because NCM authentication failed, so no report was saved. Run nsolid-plugin setup --harness <harness> to configure NodeSource credentials, then rerun the audit once credentials are in place.

When should I use ns-analyze-vulnerabilities instead of this audit?▼

Use this skill for static audits of the dependency tree before upgrading. Use ns-analyze-vulnerabilities when you need to know which vulnerabilities are actually loaded in running N|Solid processes, since a static audit does not establish runtime loading or exploitability.

Related Skills

Explore More Software Engineering Skills→
sanity-iosanity-io
952

pnpm

Manage Node.js dependencies with pnpm workspaces, catalogs, patches, and overrides.

Official
Intermediate
openaiopenai
5.3k

remotion-upgrade

Upgrade Remotion and related packages to the latest compatible versions.

Official
Intermediate
blamejsblamejs

exploit-scoring

Calculate RWEP priority scores for CVEs using exploit availability and threat patterns.

Official
Advanced
meisijiyameisijiya

springboot-verification

Verify Spring Boot Maven or Gradle projects before release.

Community
Advanced