Dependency Scan

This is a security auditing tool that checks your dependencies for known CVEs across eight package ecosystems, from npm to Rust's cargo. It wraps the standard audit tools (npm audit, pip-audit, cargo-audit) into a unified interface and pulls from databases like NVD and GitHub Advisory. The auto-fix mode is the practical bit here, it'll bump versions within semver constraints and show you what it can't fix automatically. You can filter by severity, target specific package managers, or run a broader health check that flags deprecated and unmaintained packages. Good for CI pipelines or before you merge dependency updates, especially if you're working across multiple language stacks and don't want to remember each ecosystem's audit command.

skills.sh installs: 368
GitHub stars: 182
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jwynia/agent-skills --skill dependency-scan --agent claude-code

Installs into .claude/skills of the current project.

Files

Dependency Scan

Analyze package dependencies for known vulnerabilities.

Quick Start

/dependency-scan                  # Scan all detected package managers
/dependency-scan --npm            # Node.js packages only
/dependency-scan --pip            # Python packages only
/dependency-scan --fix            # Auto-fix where possible

What This Skill Does

Identifies package managers in your project
Parses dependency manifests (package.json, requirements.txt, etc.)
Checks vulnerability databases for known CVEs
Reports severity and remediation options
Optionally auto-fixes by updating to patched versions

Supported Package Managers

Ecosystem	Files	Tool Used
Node.js	package.json, package-lock.json	npm audit
Python	requirements.txt, Pipfile, pyproject.toml	pip-audit, safety
Ruby	Gemfile, Gemfile.lock	bundler-audit
Java	pom.xml, build.gradle	dependency-check
Go	go.mod, go.sum	govulncheck
Rust	Cargo.toml, Cargo.lock	cargo-audit
PHP	composer.json, composer.lock	composer audit
.NET	*.csproj, packages.config	dotnet list --vulnerable