Mode d’emploi
- Copiez la commande et examinez le paquet avant de l’installer dans votre environnement agent.
- Consultez le document original pour les outils, identifiants et environnements requis.
- Décrivez les entrées et le livrable souhaité ; comparez la sortie aux sources.
npx skills add https://github.com/helderberto/agent-skills --skill deps-auditAvant de commencer
- L’installation n’inclut ni abonnement au modèle, ni quota API, ni accès aux fichiers.
- Étoiles et installations reflètent l’activité, pas un test indépendant de qualité ou de sécurité.
Document Skill original
Rendu depuis le dépôt source en conservant titres, exemples, code, tableaux, liens et images.
Dependency Audit
Detect the package manager from its lockfile and run that ecosystem's audit + outdated tooling. Prefer the project's own audit task if it defines one. Never assume npm.
| Ecosystem | Lockfile | Audit | Outdated |
|---|---|---|---|
| npm | package-lock.json | npm audit | npm outdated |
| pnpm | pnpm-lock.yaml | pnpm audit | pnpm outdated |
| yarn | yarn.lock | yarn npm audit (berry) / yarn audit | yarn outdated |
| Python | requirements*.txt / uv.lock / poetry.lock | pip-audit | pip list --outdated |
| Go | go.sum | govulncheck ./... | go list -m -u all |
| Rust | Cargo.lock | cargo audit | cargo outdated |
Audit tool missing → say which to install and stop. Lockfile missing → install to generate it, then retry.
Report
- Vulnerabilities, critical/high first: package@version, advisory id (CVE/GHSA/RUSTSEC), one line, the ecosystem's fix command.
- Outdated packages: package / current / latest / major vs minor.
- Obviously unused deps (grep imports in the source dir).
Action by severity: critical → fix now, blocks merge; high → before next release; moderate → this sprint; low → when convenient. Then major updates > unused > minor.
