dependency-audit

# Dependency Audit <!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions truncated or dropped, which strips the very keywords a match depends on. --> Trigger phrases: "dependency audit", "npm audit", "package security", "CVE", "license", "deprecated package" **This skill only reports.** It changes no manifest and no lockfile — bringing dependencies current is [[dependency-upgrade]], which classifies each move by risk and verifies the build. Keeping the two apart keeps this one safe to run any time, on any branch, including one you are only inspecting. ## Audit axes 1. **Known vulnerabilities (CVE):** audit appropriate to the ecosystem ```bash npm audit --production # Node dotnet list package --vulnerable # .NET (cannot be combined with --deprecated/--outdated) pip-audit # Python ``` 2. **License compliance:** flag licenses incompatible with the project such as copyleft/GPL (a risk in commercial closed source). 3. **Maintenance status:** abandoned / long-unmaintained / single-maintainer packages, and packages the registry itself marks **deprecated** — `dotnet list package --deprecated`, `npm view <pkg> deprecated`. A deprecated package is not a version problem: no bump fixes it, it needs a replacement. 4. **Transitive dependencies:** also scan vulnerabilities in indirect depe...