Skills codebase-cleanup-deps-audit
📦

codebase-cleanup-deps-audit

Low Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Audit Dependencies for Security Vulnerabilities

Keep your projects secure by identifying vulnerable, outdated, or license-incompatible dependencies. This skill scans your dependency tree, checks vulnerability databases, and provides prioritized remediation steps.

Supports: Claude Codex Code(CC)
⚠️ 68 Poor
1

Download the skill ZIP

2

Upload in Claude

Go to Settings → Capabilities → Skills → Upload skill

3

Toggle on and start using

Test it

Using "codebase-cleanup-deps-audit". Scan for vulnerabilities in a Node.js project with 45 dependencies

Expected outcome:

  • Security Audit Summary
  • Total Dependencies: 45
  • Vulnerabilities Found: 3 (1 critical, 2 high)
  • Critical: lodash <4.17.21 - Prototype Pollution (CVE-2021-23337) - Upgrade to 4.17.21
  • High: minimist <1.2.6 - Prototype Pollution (CVE-2021-44906) - Upgrade to 1.2.6
  • High: node-fetch <2.6.7 - Information Disclosure (CVE-2022-0235) - Upgrade to 2.6.7
  • Recommended Action: Run npm audit fix --force to apply patches

Using "codebase-cleanup-deps-audit". Check license compliance for a commercial project

Expected outcome:

  • License Compliance Report
  • Project License: Proprietary
  • Total Dependencies: 128
  • Issues Found: 2
  • GPL-3.0: package-name - Copyleft license incompatible with proprietary use
  • Unknown: legacy-lib - License not specified, legal review required
  • Recommendation: Replace GPL dependency with MIT alternative or obtain commercial license

Security Audit

Low Risk
v1 • 2/25/2026

Static analysis detected 50 patterns in 2 files (821 lines), but all findings are false positives from markdown documentation containing code examples. The skill is a legitimate dependency audit tool with no malicious intent. Minor risk indicators exist due to documented use of external commands and network APIs for dependency scanning.

2
Files scanned
821
Lines analyzed
6
findings
1
Total audits
Medium Risk Issues (1)
resources/implementation-playbook.md:12-748
Static Analysis False Positives - External Commands
Static scanner detected 33 'backtick execution' and shell command patterns. These are all false positives - the patterns exist in markdown code blocks (```python, ```bash, ```yaml) within documentation files, not in executable code. The skill references external commands like npm audit, pip, and git for legitimate dependency scanning operations.
Low Risk Issues (2)
resources/implementation-playbook.md:144-147resources/implementation-playbook.md:184-185resources/implementation-playbook.md:467-468
Network API References in Documentation
Static scanner detected fetch calls and HTTP client usage. These are documentation examples showing how to call vulnerability databases (npm audit API, PyPI, OSS Index) for legitimate security scanning purposes.
resources/implementation-playbook.md:234
Filesystem Operations in Examples
Hard link creation pattern detected in Python code example for dependency tree analysis. This is documentation showing file operations for scanning project directories.

Risk Factors

⚙️ External commands (3)
resources/implementation-playbook.md:584-631 SKILL.md:37 SKILL.md:53
🌐 Network access (3)
resources/implementation-playbook.md:144-147 resources/implementation-playbook.md:184-185 resources/implementation-playbook.md:467-468
📁 Filesystem access (1)
resources/implementation-playbook.md:234
Audited by: claude

Quality Score

38
Architecture
100
Maintainability
87
Content
31
Community
81
Security
91
Spec Compliance

What You Can Build

Pre-Release Security Audit

Run a comprehensive dependency audit before releasing a new version to identify and fix vulnerabilities that could affect users.

License Compliance Review

Verify that all dependencies have compatible licenses before integrating into a commercial product to avoid legal risks.

Technical Debt Assessment

Identify outdated dependencies and prioritize updates based on age, breaking changes, and security impact.

Try These Prompts

Quick Vulnerability Scan 
Scan my project for dependency vulnerabilities. Check package.json and report any critical or high severity issues with recommended fixes.
Full Dependency Audit 
Perform a complete dependency audit including vulnerability scanning, license compliance check, and outdated package analysis. Prioritize findings by severity and provide actionable remediation steps.
License Compatibility Check 
Analyze all dependencies for license compatibility with our MIT-licensed project. Flag any GPL, AGPL, or proprietary licenses and suggest alternatives.
Automated Update Plan 
Create a prioritized dependency update plan. Group updates by risk level (security patches first, then major versions), estimate effort for each, and generate update commands.

Best Practices

  • Run dependency audits on a regular schedule (weekly or before each release)
  • Pin dependency versions in lock files to ensure reproducible builds
  • Review and test security updates in staging before deploying to production

Avoid

  • Ignoring critical vulnerabilities because tests pass locally
  • Updating all dependencies at once without testing each change
  • Using dependencies with unknown or incompatible licenses in commercial products

Frequently Asked Questions

What package managers does this skill support?
The skill supports npm/Yarn (JavaScript), pip/Poetry (Python), gem (Ruby), maven/gradle (Java), go modules, cargo (Rust), composer (PHP), and NuGet (.NET).
How does the skill check for vulnerabilities?
It queries public vulnerability databases including npm audit API, PyPI safety database, GitHub Security Advisories, and Sonatype OSS Index to match your dependencies against known CVEs.
Can this skill automatically fix vulnerabilities?
The skill generates remediation commands and pull request templates, but requires user confirmation before making any changes to your project.
What should I do if a dependency has no license?
Treat unlicensed dependencies as high risk. Contact the maintainer to clarify licensing, or replace with a properly licensed alternative to avoid legal exposure.
How often should I run dependency audits?
Run audits weekly via CI/CD, before each release, and immediately when new vulnerabilities are disclosed in your dependency tree.
Does this skill check transitive dependencies?
Yes, the skill analyzes both direct dependencies and transitive dependencies (dependencies of dependencies) to provide complete coverage.

Developer Details

Author

sickn33

License

MIT

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/codebase-cleanup-deps-audit

Ref

main

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md