What problem does it solve? Node.js projects accumulate dependency risk silently: vulnerable packages, outdated majors, abandoned libraries, missing licenses, unused packages, and lockfile drift. This Skill audits the entire dependency tree against an opinionated baseline and produces structured findings plus an optional implementation plan, without ever installing or modifying anything. ## Core Features & Use Cases - Four-layer audit: Evaluates security (vulnerabilities, lockfile integrity, install scripts), health (outdated, deprecated, abandoned packages), compliance (license coverage, copyleft flagging), and hygiene (unused, misplaced, duplicate dependencies). - Static-first with opt-in network enrichment: Runs read-only by default using package.json and the lockfile; pass --with-network to enrich with the package manager's own audit and outdated registry data. - Structured outputs: Writes findings.md, findings.json (schema 2.0.0), snapshot.md, and metadata.json to .architect-audits/dependency-audit/, then offers to generate a descriptive implementation plan. - Use Case: Before a release, run the audit with --with-network to surface high-severity vulnerabilities, packages more than two majors behind, and GPL-licensed transitive dependencies, then generate a plan listing exact upgrade and removal commands for the team. ## Quick Start Ask the AI to run /dependency-audit on this Node.js project and report the top dependency risks with an implementation plan.
