dependency-audit

Automate CVE detection in project dependencies using pnpm audit.

Updated Aug 23, 2026

Search Tags:#security #dependencies #audit #remediation #pnpm #vulnerabilities #cve

Ready to run

npx skills add https://github.com/TrevorPLam/agency --skill dependency-audit-trevorplam

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-audit
Source: https://github.com/TrevorPLam/agency/tree/main/.windsurf/skills/dependency-audit
Command: npx skills add https://github.com/TrevorPLam/agency --skill dependency-audit-trevorplam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audits dependencies for known security vulnerabilities (CVEs) across the codebase and surfaces actionable remediation guidance to reduce risk.

Core Features & Use Cases

Automated CVE discovery across projects and packages.
Prioritized remediation planning and reproducible fix recommendations.
CI/CD integration to run weekly or on-demand scans and alert on high-severity issues.

Quick Start

Run the dependency-audit skill to scan all packages for CVEs and generate a prioritized remediation report.

Frequently Asked Questions about dependency-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate CVE dependency auditing across a monorepo?▼

Automating CVE dependency auditing across a monorepo involves scanning all project packages using pnpm audit to output JSON, then parsing the results to surface critical and high severity vulnerabilities in a remediation-ready report.

Can I run pnpm audit for vulnerabilities and output remediation guidance in JSON?▼

Yes, you can run pnpm audit for vulnerabilities to output JSON data, which is then parsed to filter for critical and high severity issues and formatted into a prioritized remediation report to reduce security risks.

What's the best way to integrate weekly security scans for dependencies into CI?▼

Integrating weekly security scans for dependencies into CI involves configuring reproducible audit checks using pnpm audit, enabling automated CVE discovery and alerts on high-severity issues during development workflows.

Does dependency-audit work with multiple package managers in a single project?▼

Yes, dependency-audit applies across multiple package managers and monorepos, implementing reproducible audits using pnpm audit to detect CVEs and generate remediation-ready reports for the entire codebase.

How are critical and high severity vulnerabilities prioritized in a remediation report?▼

Critical and high severity vulnerabilities are prioritized by parsing pnpm audit JSON output, filtering for these specific severities, and formatting them into a reproducible remediation-ready report to guide security fixes.