Dependency Audit

This is the kind of workflow you wish you ran more often but usually only remember after npm yells about vulnerabilities. It walks you through the full dependency maintenance cycle: scanning for CVEs, finding outdated packages, spotting unused imports, and migrating away from deprecated libraries. The skill includes commands for npm, yarn, and pnpm, plus specific steps for checking bundle impact and testing after updates. Best used as part of regular maintenance or right before a release when you need to get your house in order. With 211 installs and solid GitHub activity, it's clearly solving a real pain point for teams who want a systematic approach instead of ad hoc panic fixing.

skills.sh installs: 434
GitHub stars: 79
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add bobmatnyc/claude-mpm-skills --skill dependency-audit --agent claude-code

Installs into .claude/skills of the current project.

Files

Dependency Audit Skill

Summary

Systematic workflow for auditing, updating, and cleaning up project dependencies. Covers security vulnerability scanning, outdated package detection, unused dependency removal, and migration from deprecated libraries.

When to Use

Weekly/monthly dependency maintenance
After security advisories (CVE announcements)
Before major releases
When bundle size increases unexpectedly
During code reviews for dependency changes
Onboarding to legacy projects

Quick Audit Process

1. Check Outdated Packages

# npm
npm outdated

# pnpm
pnpm outdated

# yarn
yarn outdated

# pip (Python)
pip list --outdated

# poetry (Python)
poetry show --outdated

2. Security Vulnerability Scan

# npm
npm audit
npm audit fix          # Auto-fix where possible
npm audit fix --force  # Force major version updates (risky)

# pnpm
pnpm audit
pnpm audit --fix

# yarn
yarn audit
yarn audit --fix

# Python
pip-audit              # Requires: pip install pip-audit
safety check           # Requires: pip install safety