skills.rest
th-efool
th-efoolCOMMUNITY
Explore all skills by this author →
GitHub

dependency-auditor

Audit npm dependencies for vulnerabilities, outdated versions, and unused packages.

1|Updated Aug 8, 2026
Search Tags:#npm#bundle size#dependencies#security audit#Dependabot#vulnerability scanning#depcheck
One-click install
npx skills add https://github.com/th-efool/SKILLS --skill dependency-auditor-th-efool
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-auditor
Source: https://github.com/th-efool/SKILLS/tree/main/dependency-auditor
Command: npx skills add https://github.com/th-efool/SKILLS --skill dependency-auditor-th-efool

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? JavaScript projects accumulate vulnerable, outdated, and unused dependencies over time, creating security risks and bloated bundles that are tedious to audit manually. ## Core Features & Use Cases - Security Auditing: Run npm, pnpm, or yarn audits with JSON output and apply safe or forced fixes. - Outdated & Unused Package Detection: Use npm-check-updates and depcheck to find stale versions and dead dependencies, with guidance on common false positives like @types packages and ESLint plugins. - Bundle Size Analysis: Measure package impact with bundle analyzers, source-map-explorer, and package-phobia before installing. - Use Case: Before a release, run the full audit workflow to confirm no critical vulnerabilities, remove unused dependencies, and set up Dependabot for ongoing weekly monitoring. ## Quick Start Audit my project's npm dependencies for security vulnerabilities, outdated packages, and unused dependencies, then suggest safe updates.

Frequently Asked Questions about dependency-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check npm packages for security vulnerabilities?▼

Run npm audit to scan your dependency tree for known vulnerabilities, or npm audit --json for machine-readable output. Use npm audit fix to apply safe patches automatically, reserving npm audit fix --force for cases accepting breaking changes.

How to find unused dependencies in a Node.js project?▼

Run npx depcheck to list dependencies not imported in your code. Watch for false positives: @types packages, ESLint and Prettier plugins, PostCSS plugins, and Babel presets are often flagged but actually required by config files.

Does depcheck work with TypeScript type packages?▼

Depcheck frequently misreports @types/* packages as unused even though TypeScript needs them. Use the --ignores flag, such as npx depcheck --ignores="@types/*,eslint-*", to exclude these categories from results.

npm vs pnpm vs yarn for security auditing?▼

All three package managers support auditing: npm audit, pnpm audit, and yarn audit produce similar vulnerability reports. Choose based on which lock file your project uses, and never mix package managers in one project.

Why should I use npm ci instead of npm install in CI?▼

npm ci installs exact versions from the committed lock file, ensuring reproducible builds in CI/CD pipelines. npm install may resolve newer versions, causing inconsistent environments and unexpected breakage.

Related Skills

Explore More Software Engineering Skills→
latestaiagentslatestaiagents
5

dependency-conflict-resolver

Diagnose and resolve Node.js package dependency conflicts across npm, yarn, or pnpm.

Official
Intermediate
NicoVIIINicoVIII

merge-dependabot

Assess and merge Dependabot pull requests after verifying CI tests and dependency safety policies.

Community
Advanced
sitharaj88sitharaj88
1

dependency-audit

Audit project dependencies for vulnerabilities, outdated packages, and license compliance.

Community
Advanced
VerifiedOrganicVerifiedOrganic
1

golang-continuous-integration

Configures GitHub Actions CI/CD pipelines for Go projects covering testing, linting, security scanning, and releases.

Community
Advanced