Agent skill · software engineering · onewave-ai
dependency-auditor
Audit npm dependencies for security vulnerabilities, outdated packages, and unused dependencies. Use when checking for security issues, updating packages, or cleaning up dependencies.
Why this skill is useful
Adds specific npm commands and strategies for auditing and managing dependencies that the AI wouldn't reliably generate on its own.
What it needs
Requires npm, pnpm, yarn installed locally. About 2k tokens when loaded. Last updated 2026-07-15. 242 stars on the source repository.
What this skill does
Dependency Auditor Instructions When auditing dependencies: 1. Run security audit 2. Check for outdated packages 3. Find unused dependencies 4. Analyze bundle size impact 5. Review and update Security Audit Check Outdated Packages Find Unused Dependencies Common False Positives Depcheck may flag these as unused when they're actually needed: @types/ packages (used by TypeScript) ESLint/Prettier plugins (referenced in config) PostCSS plugins (referenced in config) Next.js plugins Babel presets Analyze Bundle Size Dependency Review Checklist Security [ ] No critical/high vulnerabilities [ ] Dependencies actively maintained [ ] No known malicious packages [ ] Lock file committed Freshness [ ] No major version behind (unless intentional) [ ] Security patches applied [ ] Deprecated packages replaced Cleanliness [ ] No unused dependencies [ ] No duplicate packages (check lock file) [ ] devDependencies vs dependencies correct Update Strategies Conservative (Recommended) Aggressive Interactive Package.json Cleanup Lock File Best Practices 1. Always commit lock files (package-lock.json, pnpm-lock.yaml, yarn.lock) 2. Use npm ci in CI/CD (not npm install) 3. Regenerate if corrupted: delete lock file + nodemodules, reinstall 4. Single lock file per project (don't mix package managers) Automated Monitoring
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills onewave-ai/dependency-auditor