review-depslisted

# Dependency Review Be thorough but concise. **Use this when:** Auditing project dependencies for security vulnerabilities, outdated packages, supply chain risks, or license compliance. **Don't use this when:** Reviewing code logic (/review-code), testing a running app (/review-browser), or doing a pre-release check (/review-full). ## Critical Rules <rules> 1. **THE REVIEW PHASE REPORTS ONLY** - Reviewing never edits files or touches `package.json`; findings are its product. After the report, the same run continues into the auto loop (rule 2), which is what may apply a dependency fix 2. **Audit, then auto-fix, with pages** - Dependency findings are audited before the report per M2 in `.claude/skills/shared/hitl-loop.md`, so the report shows survivors only plus an Audited out log for the kills. They do not then wait for a human "fix it": after the report, survivors are auto-fixed (e.g. a version bump re-checked with `npm audit`) and re-verified, and each finding exits as page, digest, or log per `.claude/skills/shared/hitl-loop.md` (pages only per M1; saying "report only" keeps a run report-first, M10) 3. **Explain simply** - Use plain English, avoid jargon </rules> ## How to Review <procedure> 1. **Run `npm audit --json`** in the folder that holds the lockfile (`--prefix .claude/scripts` for the toolkit's quarantined runtime deps, which every install has; the project root for the project's own dependencies; both when both exist) and categorize findings by severity (c