dependency-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dependency-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
!ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null !ls requirements.txt Pipfile Pipfile.lock pyproject.toml poetry.lock 2>/dev/null !ls go.mod go.sum 2>/dev/null !ls Cargo.toml Cargo.lock 2>/dev/null !ls Gemfile Gemfile.lock 2>/dev/null !ls *.csproj *.sln 2>/dev/null !ls composer.json composer.lock 2>/dev/null !ls mix.exs mix.lock 2>/dev/null
Run the appropriate audit command:
| Ecosystem | Command | ||
|---|---|---|---|
| npm | npm audit --json | ||
| yarn | yarn audit --json | ||
| pnpm | pnpm audit --json | ||
| pip | `pip audit 2>/dev/null \ | \ | pip-audit 2>/dev/null` |
| Go | govulncheck ./... 2>/dev/null | ||
| Rust | cargo audit 2>/dev/null | ||
| Ruby | bundle audit check 2>/dev/null | ||
| .NET | dotnet list package --vulnerable 2>/dev/null | ||
| PHP | composer audit 2>/dev/null |
For each vulnerability found:
Run the appropriate command:
| Ecosystem | Command |
|---|---|
| npm | npm outdated --json |
| pip | pip list --outdated 2>/dev/null |
| Go | go list -m -u all 2>/dev/null |
| Rust | cargo outdated 2>/dev/null |
| Ruby | bundle outdated 2>/dev/null |
Classify updates:
Look for dependencies that are imported in package manifest but never referenced in code:
Note: Some dependencies are used via CLI, plugins, or config — verify before removing.
Check for problematic licenses:
| Package | Version | Severity | CVE | Fix Available |
|---|
| Package | Current | Latest | Update Type | Breaking? |
|---|
| Package | Last Import Found | Recommendation |
|---|
| Package | License | Risk Level |
|---|
Rate dependency health from 0 to 10 (10 = all up to date, no vulns).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.