dependency-audit
SkillSecurityUse when running ecosystem-specific vulnerability scans across project dependencies (npm/composer/pip/cargo/go/etc), with optional auto-fix.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the dependency-audit skill
What this skill tells your AI
The instructions your AI receives, as published by fusengine/agents in plugins/security-expert/skills/dependency-audit/SKILL.md and read by ahel’s review.
It parses each tool's output, classifies findings by severity (CRITICAL/HIGH/MEDIUM/LOW), and suggests fix versions or alternatives. With the --fix flag it applies safe auto-fixes where supported (npm audit fix, cargo audit fix) and gives manual guidance for ecosystems without auto-fix.
Out of scope: researching a single named dependency's CVE history in depth belongs to cve-research.
Dependency Audit Skill
Overview
Run dependency vulnerability checks using native package manager audit tools.
Supported Ecosystems
| Ecosystem | Tool | Auto-fix |
|---|---|---|
| npm/yarn/pnpm/bun | npm audit / yarn audit | Yes |
| PHP/Composer | composer audit | Manual |
| Python/pip | pip-audit / safety check | Manual |
| Rust/Cargo | cargo audit | Yes |
| Go | govulncheck ./... | Manual |
| Swift/CocoaPods | pod audit | Manual |
| Ruby/Bundler | bundle audit | Manual |
Workflow
- Detect package manager from lock files
- Run appropriate audit command
- Parse output for vulnerabilities
- Classify by severity (CRITICAL/HIGH/MEDIUM/LOW)
- Suggest fix versions or alternatives
Auto-Fix Support
When --fix flag is used:
npm audit fixfor safe updatescargo audit fixfor Rust- Manual guidance for other ecosystems
References
Signals
- GitHub stars
- 25
- Forks
- 4
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
dependency-audit-fusengine- Source
- github.com/fusengine/agents