Agent skill · mia-cx
audit-dependencies
Use when the user asks to audit, check, or upgrade dependencies, or mentions vulnerabilities, outdated packages, or dependency bloat.
What it needs
About 4k tokens when loaded.
What this skill does
Audit Dependencies Audit dependencies and propose fixes. The one exception: security findings with a safe update path are applied on the spot. Every other finding becomes a proposal (finding + suggested fix + risk + effort); the user picks what to act on. Classes Security (generic, not e18e): vulnerabilities and CVEs, covered by the ecosystem's audit commands. The e18e.dev classes: ✨ Cleanup — debt in the dependency tree: packages that are redundant, bloated, unused, or no longer maintained. Prefer the shallowest possible graph — fix by removing, or migrating to lighter/faster alternatives and platform built-ins. ⚡️ Speedup — runtime performance of the packages and code in use: lint-detectable patterns (barrel files, redundant re-exports) and slow hot-path idioms. Profile before proposing. 🧩 Levelup — adopting modern, lean, focused alternatives to heavyweight established tools (the esbuild-vs-webpack archetype; see tinylibs, unjs, es-tooling). Workflow 1. Detect package manager and ecosystem Detect the manager from the lockfile and use its audit/outdated commands. For non-JS ecosystems (pyproject.toml, go.mod, Cargo.toml), adapt commands; the classes and the propose/apply rules still apply. 2. Security Run the manager's audit command. Per vulnerability: package, installed version, patched version, CVE, direct or transitive. Severity sets urgency: critical/high → before next release; moderate → near term; low → when convenient. Safe fixes are applied directly: a patched version exists within the same major (patch/minor bump). Update, then verify with typecheck + test before committing. Fixes that require a major bump or API changes become proposals like everything else. For transitive vulnerabilities, propose one of: bump the direct dep that pulls in the fix; a documented override (pnpm.overrides) linking the upstream issue and naming its removal condition; or a written risk acceptance when the vulnerable path is unreachable. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills mia-cx/audit-dependencies