skills.rest
cacheforge-ai
cacheforge-aiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

dep-audit

Audit project dependencies for known CVEs across npm, pip, Cargo, and Go.

10|2|Updated Feb 14, 2026
Search Tags:#automation#security#vulnerability#dependencies#audit#supply-chain#cve
One-click install
npx skills add https://github.com/cacheforge-ai/cacheforge-skills --skill dep-audit-cacheforge-ai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-audit
Source: https://github.com/cacheforge-ai/cacheforge-skills/tree/main/skills/dep-audit
Command: npx skills add https://github.com/cacheforge-ai/cacheforge-skills --skill dep-audit-cacheforge-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, npm, pip-audit, cargo-audit, govulncheck, syft, curl, and includes scripts (resource) components.

What problem does it solve?

Dependency management often leaves projects vulnerable to CVEs embedded in dependencies. This skill provides centralized detection, reporting, and guidance to fix known vulnerabilities across npm, Python (pip), Rust (Cargo), and Go ecosystems.

Core Features & Use Cases

  • Auto-detects vulnerabilities by scanning common lockfiles (package-lock.json, Pipfile.lock, poetry.lock, Cargo.lock, go.sum).
  • Normalizes and aggregates findings into a single view with actionable fix commands.
  • Generates an SBOM and provides a clear remediation path for monorepos or multi-repo projects.

Quick Start

Audit a project directory containing a lockfile to generate a vulnerability report and suggested fixes.

Frequently Asked Questions about dep-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit dependencies for known vulnerabilities across multiple ecosystems?▼

Yes, it can generate a CycloneDX SBOM on demand by analyzing detected lockfiles to document the software supply chain composition for security tracking.

Can I scan a monorepo for CVEs in npm, pip, Cargo, and Go projects at the same time?▼

No, it enforces a report-only safety model by default to prevent unintended changes, but it surfaces actionable fix commands on demand for manual execution.

What tools do I need to run a pip audit or Go vulnerability check?▼

It uses syft to generate an SBOM and aggregates vulnerability data from npm, pip-audit, cargo-audit, and govulncheck into a unified markdown report.

Does this dependency audit tool automatically apply fixes to vulnerable packages?▼

It detects lockfiles like package-lock.json, Pipfile.lock, poetry.lock, Cargo.lock, and go.sum to run ecosystem-specific vulnerability audits.

Can I generate a CycloneDX SBOM from my project dependencies?▼

It supports npm, pip, Cargo, and Go ecosystems by running npm, pip-audit, cargo-audit, and govulncheck to detect and report known CVEs from lockfiles.

Related Skills

Explore More Software Engineering Skills→
diShine-digital-agencydiShine-digital-agency
1

shine-dep-audit

Detect known dependency vulnerabilities across multiple ecosystems and report CVE details with upgrade guidance.

Community
Advanced
vecearvecear

artifact-sbom-publisher

no

Community
Advanced
AgentSecOpsAgentSecOps
183

sbom-syft

Generates SBOMs from container images, file systems, and archives via Syft.

Official
Advanced
softsparksoftspark
161

cve-scan

Detect known CVEs in project dependencies using native package manager audit tools.

Community
Intermediate