dependency-audit — Claude Code command: what it does, how to install
Audits project dependencies for known CVEs, license compliance issues, and outdated packages across multiple ecosystems.
npx claude-code-templates@latest --command security/dependency-auditWhat dependency-audit does
This command scans repository dependencies by parsing package manifests and lockfiles. It inspects files such as package.json, requirements.txt, Cargo.toml, and pom.xml, pairing them with relevant lockfiles.
Execution relies on Read, Bash, and Grep tools inside Claude Code. The prompt calls scanners like npm audit, pip check, or cargo audit to catch CVEs, then invokes npm outdated or pip list --outdated. The resulting summary lists prioritized security flaws and flags licensing risks.
Without native package managers installed in the environment, automated CLI scans fail and the audit drops back to manual file reading.
What it helps with
- Scan project dependencies for known security vulnerabilities and CVEs
- Identify outdated packages prior to breaking upgrades
- Review dependency licenses for legal compliance obligations
- Spot unused packages that bloat bundle sizes
Example prompts for the agent
- /dependency-audit --security
- /dependency-audit --licenses
- /dependency-audit --all
How to install dependency-audit
1claude-code-templates
npx claude-code-templates@latest --command security/dependency-audit2Manually: put the files in place
.claude/commands/dependency-audit.mdCall it with /dependency-audit. For all projects use ~/.claude/commands/
Manually: put the files in place
~/.codex/prompts/dependency-audit.mdCall it with /prompts:dependency-audit. Codex marks this format deprecated in favour of skills
Manually: put the files in place
.github/prompts/dependency-audit.prompt.mdManually: put the files in place
.gemini/commands/dependency-audit.tomlGemini stores commands as TOML: the prompt text goes into the prompt field
Questions about dependency-audit
How to install dependency-audit in Claude Code?
Run npx claude-code-templates@latest --command security/dependency-audit in your terminal or add the prompt file to .claude/commands/dependency-audit.md.
What does dependency-audit do?
It inspects project dependencies using manifest files and native audit tooling. The output delivers a prioritized report on security advisories, license compliance, and package updates.
What arguments does dependency-audit support?
You can narrow the run using --security for vulnerability scanning, --licenses for legal checks, --updates for version analysis, or --all for a full audit.
Source text
dependency-audit.md · MIT
--- allowed-tools: Read, Bash, Grep argument-hint: "[scope] | --security | --licenses | --updates | --all" description: Audit dependencies for security vulnerabilities, license compliance, and update recommendations --- # Dependency Audit Audit dependencies for security vulnerabilities and compliance: **$ARGUMENTS** ## Current Dependencies - Package files: @package.json or @requirements.txt or @Cargo.toml or @pom.xml - Lock files: @package-lock.json or @poetry.lock or @Cargo.lock - Security scan: !`npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || cargo audit 2>/dev/null || echo "No security scanner available"` - Outdated packages: !`npm outdated 2>/dev/null || pip list --outdated 2>/dev/null || echo "Check manually"` ## Task Perform comprehensive dependency security and compliance audit: **Audit Scope**: Use $ARGUMENTS to focus on security, licenses, updates, or complete audit **Analysis Areas**: 1. **Vulnerability Scanning** - Known CVEs, security advisories, exploit availability 2. **Version Analysis** - Outdated packages, breaking changes, update recommendations 3. **License Compliance** - License compatibility, restrictions, legal obligations 4. **Supply Chain Security** - Package authenticity, maintainer status, suspicious dependencies 5. **Performance Impact** - Bundle size, unused dependencies, optimization opportunities **Output**: Prioritized security report with critical vulnerabilities, recommended actions, and compliance status.
© davila7 · MIT · davila7/claude-code-templates
