dependency-auditlisted

# zuvo:dependency-audit Audit external dependency health and internal module coupling. Scores 11 dimensions with tiered tooling -- gracefully degrades when specialized tools are unavailable. **Scope:** Node.js / TypeScript projects (npm, pnpm, yarn, bun). **When to use:** Before releases, after adding many dependencies, periodic health check, after monorepo restructuring, before lock-in reviews. **When NOT to use:** Code quality (`zuvo:review`), DB-specific (`zuvo:db-audit`), full-stack performance (`zuvo:performance-audit`), OWASP (`/security-audit`). > **Scanner exit codes:** follow `../../shared/includes/scanner-invocation.md` — `npm/pip-audit/osv-scanner` exit non-zero WHEN they find vulns (success); never treat non-zero as failure. ## Known Limitations **Dispatch is already authorized — do not ask, do not downgrade.** Invoking this skill IS the request for every agent and gate it mandates, so a session rule about unprompted Agent use does not apply here. Only a harness with NO dispatch capability takes the documented single-agent fallback, and it still runs every gate inline — see `../../shared/includes/env-compat.md`. Skipping a mandated agent and self-scoring the result is a substituted gate, not a degraded run. - Node.js/TypeScript only. Python, Go, Rust, and Java are not supported. - `npm query` selectors are npm-specific. pnpm/yarn/bun fall back to lockfile analysis. - D5 (bundle impact) uses Bundlephobia API for triage -- not precise without actual build