skills.rest
0xjitsu
0xjitsuCOMMUNITY
Explore all skills by this author →
Website𝕏@0xjitsuGitHub

dep-audit

Audit JavaScript/Node.js dependencies for CVEs, outdated packages, and unused modules.

1|Updated Apr 13, 2026
Search Tags:#security#npm#dependencies#audit#vulnerability-scanning#depcheck#sonatype
One-click install
npx skills add https://github.com/0xjitsu/jitsu-skills --skill dep-audit-0xjitsu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-audit
Source: https://github.com/0xjitsu/jitsu-skills/tree/main/skills/dep-audit
Command: npx skills add https://github.com/0xjitsu/jitsu-skills --skill dep-audit-0xjitsu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates detection and prioritization of dependency vulnerabilities, outdated packages, and unused modules so teams can remediate risks before release.

Core Features & Use Cases

  • Vulnerability Scanning: Parse npm audit JSON to extract advisory ID, severity, package, patched version, CVSS score, and CWE.
  • Cross-Reference Recommendations: Query Sonatype MCP when available to suggest safe package versions and surface license risk.
  • Remediation Guidance: Produce a severity-sorted findings table with one-line npm fix commands and an overall summary of remaining issues.
  • Outdated & Unused Checks: Run npm outdated and depcheck (if installed) to list outdated packages, wanted/latest versions, and unused or missing dependencies.
  • Use Case: Run a pre-release audit for a Node.js project or monorepo to identify direct and transitive CVEs and produce safe upgrade suggestions.

Quick Start

Run a dependency audit and produce a severity-sorted findings table with suggested one-line npm fix commands for the current project.

Frequently Asked Questions about dep-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm dependencies for vulnerabilities before release?▼

Audit npm dependencies by parsing npm audit JSON to extract advisory ID, severity, CVSS score, and patched versions. The scan covers direct and transitive CVEs and outputs a severity-sorted findings table with one-line fix commands.

Does dependency auditing work with monorepos and release pipelines?▼

Yes, auditing works with monorepos and release pipelines. You can run pre-release checks across JavaScript and Node.js projects to identify direct and transitive CVEs, outdated packages, and unused modules while preserving lockfile integrity.

How do I fix unused and outdated npm packages?▼

Fix unused and outdated npm packages by running npm outdated alongside depcheck if installed. This lists wanted and latest versions and flags unused or missing dependencies, generating one-line npm fix commands for safe upgrades.

Can I get safe version recommendations for vulnerable npm packages?▼

Yes, you can get safe version recommendations by cross-referencing vulnerabilities with Sonatype MCP when available. This surfaces safe package versions and license risks alongside CVSS scores and patched versions.

Will a dependency audit forcefully upgrade my packages without permission?▼

No, dependency auditing avoids forceful upgrades without user confirmation. It preserves lockfile integrity and provides suggested one-line npm fix commands, ensuring you control when package versions change.

Related Skills

Explore More Software Engineering Skills→
baekenoughbaekenough
34

npm-audit

Audit npm dependencies for security vulnerabilities and outdated packages.

Community
Intermediate
j4hr3nj4hr3n

fix-grype-tf

Auto-fix Grype scan vulnerabilities by updating dependencies and opening PRs.

Community
Advanced
eduardo-sleduardo-sl
64

go-dependency-audit

Audit Go module dependencies for outdated packages and known vulnerabilities.

Community
Intermediate
kfolkeskfolkes
2

dependency-check-security-scan

Scan project dependencies for known CVEs using OWASP Dependency-Check.

Community
Intermediate