/audit-deps — Dependency Audit

Audit project dependencies for security vulnerabilities, outdated packages, and license compliance.

Usage

/audit-deps
/audit-deps path/to/project

What It Checks

1. Vulnerability Scan

npm audit --json

Severity	Action
Critical	Immediate ticket, block deploys
High	Ticket this week
Moderate	Ticket this sprint
Low	Track in backlog

2. Outdated Packages

npm outdated --json

• Major version behind → review breaking changes
• Minor version behind → schedule update
• Patch behind → update ASAP

3. License Compliance

• Allowed: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, 0BSD, Unlicense
• Restricted (require approval): GPL-2.0, GPL-3.0, LGPL, AGPL, MPL, CDDL
• Banned: UNLICENSED, Unknown, Proprietary

4. Dependency Health

• Abandoned packages (no updates > 2 years)
• Low download counts
• No maintainer activity
• Known malicious packages

Output

Generates a report with:

• Vulnerability summary by severity
• Critical / High vulnerability details with CVE
• Outdated packages list
• License issues
• Recommendations

Optionally creates tickets in the team's tracker for Critical / High vulnerabilities.

Invokes: Dependency Auditor Agent (Guardian)

---

Part of ApexYard — multi-project SDLC framework for Claude Code · MIT.