skills.rest
cerico
cericoCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

audit

Analyze npm audit results to classify direct and transitive vulnerabilities.

Updated Sep 12, 2021
Search Tags:#security#npm#audit#pnpm#vulnerabilities#dependency-management#exploitability
One-click install
npx skills add https://github.com/cerico/macfair --skill audit-cerico
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit
Source: https://github.com/cerico/macfair/tree/main/files/claude/skills/audit
Command: npx skills add https://github.com/cerico/macfair --skill audit-cerico

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill analyzes npm audit results to separate actionable vulnerabilities from noise, providing concrete remediation steps.

Core Features & Use Cases

  • Direct vs Transitive classification: identify whether a vulnerability is a direct dependency or a transitive one.
  • Production vs Dev assessment: determine if a vulnerability affects production or development builds.
  • Override and fix guidance: propose updates, overrides, or workarounds and justify them.
  • Use Case: Before deployment, run the audit and generate an action plan for remediation.

Quick Start

Run pnpm audit --json 2>/dev/null || true on the project and provide a prioritized remediation plan.

Frequently Asked Questions about audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I interpret npm audit results to distinguish direct vs transitive vulnerabilities?▼

To interpret npm audit results, you must distinguish direct dependencies from transitive ones by analyzing the package tree. This classification determines whether you update the package directly or use overrides to remediate the vulnerability.

What is the best way to fix npm vulnerabilities found in production vs dev dependencies?▼

The best way to fix npm vulnerabilities is to classify each finding as production or dev, assess its exploitability, and apply targeted updates or overrides. This approach ensures you address critical production risks before dev build issues.

Can I use pnpm audit with Yarn and NPM lockfiles to apply overrides?▼

Yes, you can use the analysis across PNPM, Yarn, and NPM scenarios by running the audit command and evaluating the JSON output. The tool checks for existing overrides and suggests fixes or workarounds accordingly.

How do I generate an action plan for npm vulnerability remediation before deployment?▼

To generate a remediation action plan, run your package manager's audit command with JSON output and analyze the results. The analysis prioritizes fixes based on exploitability, dependency type, and available overrides.

Why does my npm audit report show transitive vulnerabilities and how do I resolve them?▼

Npm audit reports show transitive vulnerabilities because they are introduced indirectly through your direct dependencies. You resolve them by applying package overrides or updating the direct dependency that requires the vulnerable package.

Related Skills

Explore More Software Engineering Skills→
shoji9x9shoji9x9

pnpm-audit-alert-issue

Normalize pnpm audit JSON output into structured findings with dependency paths.

Community
Intermediate
imMamdouhaboammarimMamdouhaboammar

dependency-updater

Detect project types and apply safe dependency updates across multiple languages.

Community
Advanced
luokai25luokai25

devsecops-expert

Integrates security scans into CI/CD pipelines automating vulnerability detection.

Community
Advanced
alex-voloshin-devalex-voloshin-dev
2

security-scan

Automate dependency vulnerability checks, secret detection, and OWASP compliance reviews.

Community
Advanced