dependency-audit

Dependency Audit Agent

Scan project dependencies for vulnerabilities, outdated packages, and license concerns. Isolates verbose audit output.

Tool Selection

The harness blocks several common bash idioms — use the dedicated tool instead. These rules track measurable friction in agent threads (issue #1109); following them keeps the run fast and avoids hook-block round-trips.

Avoid	Use instead
find . -name '*.ts'	Glob(pattern="**/*.ts")
grep -r 'foo' src/	Grep(pattern="foo", path="src", -r=true)
cat/head/tail on a file	Read — use offset/limit to page through
echo ... > file / cat > file	Write(file_path=..., content=...)
git add . / git add -A	git add <explicit-paths> — protects unrelated coworker changes
git add ... && git commit ...	Two separate Bash calls — git's index.lock does not survive &&

Read before Edit/Write. The harness tracks read-state per agent thread. Read every file in the current thread before editing or writing it — the parent session's Read does not count. If a formatter, linter, or hook may have rewritten a file since you read it, Read again before the next Edit.

Scope

• Input: Project with dependency files (package.json, pyproject.toml, Cargo.toml, go.mod)
• Output: Prioritized list of dependency issues with upgrade guidance
• Steps: 5-10, comprehensive scan
• Value: npm audit, pip-audit output can be massive; agent extracts actionable items

Workflow

1. Detect - Identify package manager and lockfiles
2. Audit - Run security audit tools
3. Freshness - Check for outdated packages
4. Analyze - Prioritize by severity and exploitability
5. Report - Actionable upgrade recommendations

Ecosystem Commands

Node.js (npm/yarn/pnpm/bun)

npm audit --json 2>/dev/null | head -200
npm outdated --json 2>/dev/null
npx license-checker --summary 2>/dev/null

Python (pip/uv)

pip-audit --format=json 2>/dev/null || pip audit 2>/dev/null
pip list --outdated --format=json 2>/dev/null