depslisted

# Dependency Hygiene Audit installed dependencies for known vulnerabilities and propose a safe response. This skill **proposes** — it never edits manifests/lockfiles or upgrades anything. The user decides. ## Phase 0 — Load profile 1. Read `.claude/PROJECT.md` → **Stack → Package manager** and **Commands**. The package manager determines the audit command; never guess it. 2. If `PROJECT.md` is missing or still `TEMPLATE`, fall back to the root `CLAUDE.md` (always in context) when it names the package manager / audit command — note you're running without a kit profile. Only if *neither* has them, run `/bootstrap` first. 3. Skim `rules/_generic/code.md` → *Dependency trust* for the principles this skill applies. ## Phase 1 — Resolve the audit command Derive the audit command from the package manager. If `PROJECT.md → Commands` already names an `audit` command, use that verbatim. Otherwise map from the package manager: | Package manager | Audit command | |-----------------|---------------| | npm | `npm audit` | | yarn (Berry) | `yarn npm audit` | | yarn (classic) | `yarn audit` | | pnpm | `pnpm audit` | | bundler (Ruby) | `bundle exec bundler-audit check --update` (or `bundle-audit`) | | pip / uv / poetry | `pip-audit` (or `uv pip audit`) | | cargo | `cargo audit` | | go | `govulncheck ./...` | If the package manager isn't in the table, or the audit tool isn't installed (`command -v` check fails), use **AskUserQuestion** to confirm the right command rather than g