deps-audit

Files (2)

• README.md
• SKILL.md

SKILL.md (first lines)

# Cross-Project Dependency Audit

Scan one or more projects for dependency vulnerabilities, outdated packages, and cross-project version inconsistencies.

## Selecting Projects to Scan

Decide what to audit, in this order:

1. **A path passed as an argument** — audit exactly that project directory.
2. **A workspace root** — if you keep several projects under one directory (e.g. `~/projects`), scan each immediate subdirectory that contains a dependency manifest.
3. **The current directory** — if neither of the above applies, audit the project in the current working directory.

Ask the user which scope they want if it is ambiguous.

## Arguments

Parse `$ARGUMENTS`:

- **No arguments or `--all`:** Audit every discovered project (default)
- **`--python`:** Only audit Python projects
- **`--node`:** Only audit Node.js projects
- **`<project-path>`:** Audit a specific project directory

## Process

### Step 1: Discover Manifests

For each project in scope, check which dependency manifests exist:

```bash
# Python manifests
test -f <path>/requirements.txt && echo "requirements.txt"
test -f <path>/pyproject.toml && echo "pyproject.toml"

# Node manifests (check root and common subdirs like frontend/, web/, apps/)
test -f <path>/package.json && echo "package.json"
test -f <path>/frontend/package.json && echo "frontend/package.json"
test -f <path>/web/package.json && echo "web/package.json"
test -f <path>/apps/web/package.json && echo "apps/web/package.json"
test -f <path>/apps/api/package.json && echo "apps/api/package.json"

# Go manifests
test -f <path>/go.mod && echo "go.mod"
```

Skip projects with no manifests.

**Output a discovery table first:**
```
## Manifest Discovery
| Project | Python | Node | Go |
|---------|--------|------|----|
| api-service | requirements.txt | — | — |
| web-app | pyproject.toml | frontend/package.json | — |
| platform | pyproject.toml | web/package.json | — |
| dashboard | — | apps/web/package.json, apps/api/package.json | — |
| cli-tool | — | package.json (pnpm) | — |
```

### Step 2: Python Vulnerability Audit

For each project with Python dependencies:

**Option A — pip-audit available:**
```bash
cd <path> && pip-audit -r requirements.txt 2>&1
# OR
cd <path> && pip-audit 2>&1  # (uses pyproject.toml)
```

**Option B — pip-audit not available (fallback):**
```bash
# Check if pip-audit is installed
pip-audit --version 2>/dev/null || python3 -m pip_audit --version 2>/dev/null
```

If pip-audit is not installed, use safety or manual checking:
```bash
# Try safety
safety check -r <path>/requirements.txt 2>&1

# If neither available, report
echo "Neither pip-audit nor safety installed. Install with: pip install pip-audit"
```

**Option C — Read and report versions manually:**
If no audit tool is available, read the requirements file and report the dependency list with a note that automated vulnerability scanning needs `pip-audit` installed:
```bash
cat <path>/requirements.txt | grep -v "^#" | grep -v "^$" | head -30
```

### Step 3: Node.js Vulnerability Audit

For each project with Node.js dependencies:

Detect the package manager first:
```bash
test -f <path>/pnpm-lock.yaml && echo "pnpm"
test -f <path>/yarn.lock && echo "yarn"
test -f <path>/bun.lockb && echo "bun"
test -f <path>/package-lock.json && echo "npm"
```

Then run the appropriate audit:
```bash
# npm
cd <path> && npm audit --json 2>/dev/null | python3 -c "
import sys,json
try:
    d=json.load(sys.stdin)
    v=d.get('metadata',{}).get('vulnerabilities',{})
    print(f\"  critical: {v.get('critical',0)}, high: {v.get('high',0)}, moderate: {v.get('moderate',0)}, low: {v.get('low',0)}\")
except: print('  Could not parse audit output')
"

# pnpm
cd <path> && pnpm audit --json 2>/dev/null | python3 -c "
import sys,json
try:

From PatriotAgenticLLC/better_claude_skillz, MIT.

More from PatriotAgenticLLC/better_claude_skillz