hatch3r-dep-audit

> **Note:** Commands below use `npm` as an example. Substitute with your project's package manager (`yarn`, `pnpm`, `bun`) or build tool when your project uses a different package manager. # Dependency Audit Workflow ## Quick Start ``` Task Progress: - [ ] Step 0: Detect ambiguity (P8 B1) - [ ] Step 1: Run npm audit + npm outdated, categorize findings - [ ] Step 2: Research CVEs via web search for critical/high - [ ] Step 3: Plan upgrades (breaking vs non-breaking, bundle impact) - [ ] Step 4: Implement upgrades one-by-one, run tests after each - [ ] Step 5: Verify quality gates and bundle size - [ ] Step 6: Open PR with upgrade rationale ``` ## Step 0 — Detect Ambiguity (P8 B1) Before any work, scan the invocation for unresolved questions in scope, intent, acceptance criteria, target environment, or irreversibility. If any are found, ask the user via the platform-native question tool per `agents/shared/user-question-protocol.md`. Do not proceed under silent assumption. Default path, not an exception. Triggers for THIS skill: scope (critical/high only vs all), major-version-bump authority, bundle-size budget, deferral policy when no fix is available, and whether to also remove unused deps in the same pass. ## Fan-out Discipline (P8 B2) Fan-out scales with task size; token cost never justifies serializing independent work (`rules/hatch3r-fan-out-discipline.md` P8 B2; `agents/shared/efficiency-patterns.md`). Emit `sub_agents_spawned: { count, rationale, task_structure }`...