deps-audit
Installation
SKILL.md
Dependency Audit
Detect the package manager from its lockfile and run that ecosystem's audit + outdated tooling. Prefer the project's own audit task if it defines one. Never assume npm.
| Ecosystem | Lockfile | Audit | Outdated |
|---|---|---|---|
| npm | package-lock.json |
npm audit |
npm outdated |
| pnpm | pnpm-lock.yaml |
pnpm audit |
pnpm outdated |
| yarn | yarn.lock |
yarn npm audit (berry) / yarn audit |
yarn outdated |
| Python | requirements*.txt / uv.lock / poetry.lock |
pip-audit |
pip list --outdated |
| Go | go.sum |
govulncheck ./... |
go list -m -u all |
| Rust | Cargo.lock |
cargo audit |
cargo outdated |
Audit tool missing → say which to install and stop. Lockfile missing → install to generate it, then retry.