dependency-auditlisted

# Dependency Audit A structured, evidence-based check of a project's third-party dependencies — vulnerabilities, staleness, license risk, dead weight, lockfile integrity, and supply-chain hygiene — across every package manager present in the repo. This is a deeper, broader complement to `cybersecurity-check` (which covers dependency vulnerabilities as a single line item, S16); this skill is the one to reach for whenever dependencies themselves — not the rest of the application surface — are the actual subject of the question. ## Ground rules - **Evidence or it didn't happen.** Every row needs a concrete pointer: an actual command and its actual output, an actual version number, an actual CVE/advisory ID, an actual file:line. Never write "dependencies look fine," "packages appear up to date," or "no vulnerabilities found" as a standalone claim — report what tool ran, against what manifest, and what it printed. - **A ✅ means "the audit tool ran and reported clean" — not "there are definitely no vulnerabilities."** Audit tools have real false-negative rates, especially for vulnerabilities disclosed in the last few days (the advisory database hasn't caught up yet) and for transitive/indirect dependencies some tools don't fully walk. Say this caveat once, up front, so the user doesn't over-trust a clean run. Phrase findings as "`npm audit` reported 0 vulnerabilities as of <date>," not "this project has no vulnerable dependencies." - **Don't invent scope you can'