Dependency Audit
Audit dependencies for security vulnerabilities, license compliance, and update recommendations
npx claude-code-templates@latest --command security/dependency-audit Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-23
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
No observations.
Learn more about NVIDIA SkillSpector.
Content
Dependency Audit
Audit dependencies for security vulnerabilities and compliance: $ARGUMENTS
Current Dependencies
- Package files: @package.json or @requirements.txt or @Cargo.toml or @pom.xml
- Lock files: @package-lock.json or @poetry.lock or @Cargo.lock
- Security scan: !
npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || cargo audit 2>/dev/null || echo "No security scanner available" - Outdated packages: !
npm outdated 2>/dev/null || pip list --outdated 2>/dev/null || echo "Check manually"
Task
Perform comprehensive dependency security and compliance audit:
Audit Scope: Use $ARGUMENTS to focus on security, licenses, updates, or complete audit
Analysis Areas:
- Vulnerability Scanning - Known CVEs, security advisories, exploit availability
- Version Analysis - Outdated packages, breaking changes, update recommendations
- License Compliance - License compatibility, restrictions, legal obligations
- Supply Chain Security - Package authenticity, maintainer status, suspicious dependencies
- Performance Impact - Bundle size, unused dependencies, optimization opportunities
Output: Prioritized security report with critical vulnerabilities, recommended actions, and compliance status.