Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Sagargupta16/claude-skills --skill deps-auditgit clone --depth 1 https://github.com/Sagargupta16/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sagargupta16/claude-skills/deps-audit)<a href="https://agentmods.dev/skills/sagargupta16/claude-skills/deps-audit"><img src="https://agentmods.dev/badge/skills/sagargupta16/claude-skills/deps-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sagargupta16/claude-skills/deps-audit"><img src="https://agentmods.dev/badge/skills/sagargupta16/claude-skills/deps-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01559 |
| Opus 5 | $0.00023 | $0.00779 |
| Sonnet 5 | $0.00009 | $0.00312 |
| Haiku 4.5 | $0.00005 | $0.00156 |
Grade A, and why
deps-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency Audit and Management
Quick Reference
| Task | Approach |
|---|---|
| Security scan | Run language-specific audit command |
| Find outdated | Check against latest versions |
| Find unused | Analyze imports vs declared dependencies |
| Update safely | Minor/patch first, test, then major |
| Lock files | Always commit lock files |
Package Manager Detection
| File | Package Manager | Audit Command |
|---|---|---|
pnpm-lock.yaml |
pnpm | pnpm audit |
package-lock.json |
npm | npm audit |
yarn.lock |
yarn | yarn audit |
bun.lockb |
bun | bun audit (if available) |
requirements.txt |
pip | pip-audit |
pyproject.toml (with uv) |
uv | uv pip audit |
poetry.lock |
poetry | poetry audit (via plugin) |
Cargo.lock |
cargo | cargo audit |
go.sum |
go | govulncheck ./... |
Security Vulnerability Scanning
Node.js
# Check for known vulnerabilities
pnpm audit
# or
npm audit
# Auto-fix compatible updates
pnpm audit --fix
# or
npm audit fix
# See what would change without applying
npm audit fix --dry-run
# Force fixes (may include breaking changes)
npm audit fix --force # Use with caution
Python
# Install pip-audit if not present
pip install pip-audit
# Scan requirements.txt
pip-audit -r requirements.txt
# Scan installed packages
pip-audit
# Output as JSON for processing
pip-audit --format json
# Fix vulnerabilities
pip-audit --fix -r requirements.txt
Rust
# Install cargo-audit
cargo install cargo-audit
# Scan for vulnerabilities
cargo audit
# Auto-fix compatible updates
cargo audit fix
Go
# Install govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest
# Scan for vulnerabilities
govulncheck ./...
Outdated Package Detection
Node.js
# List outdated packages
pnpm outdated
# or
npm outdated
# Interactive update (pnpm)
pnpm update --interactive --latest
Python
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 267 lines · 46 tokens per session scan A 5e8bbdb02a47
deps-audit is a skill published in the GitHub repository Sagargupta16/claude-skills (5 stars, last pushed 6d ago), licensed MIT. It adds 46 tokens to every session and 1,559 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kanban-dev-lane
Use when a Hermes Kanban worker wants to run an autonomous implementation delegation lane with a 3-tier fallback chain across claudy -> codex (--yolo) -> agyd (agy --dangerously-skip-permissions) -> Hermes direct on quota exhaustion.
release
This skill should be used when the user wants to create a new release — bump version, tag, push, create GitHub release, and optionally publish to npm. Use when user says "release", "bump version", "publish", "cut a release", or "release candidate".
council
4-voice parallel deliberation for architecture, tech selection, or design decisions with no clear answer. Each voice gets independent context to prevent anchoring bias. Use when the user says "council", "deliberate", "second opinion", or faces a trade-off between multiple valid approaches.
orbit
Autonomous pipeline — spec requirements, execute implementation, audit quality, and ship. Runs the full epic-harness orbit cycle in one go. Use when the user says "orbit", "full pipeline", "spec to ship", or describes a feature that needs end-to-end handling.
reflect
Self-assessment of AI session quality. Scores 5 dimensions from session data and harness memory. Not an agent performance review — it's human self-reflection on how well they used AI assistance. Use when the user says "reflect", "how did I do", "session review", or at the end of a long session.
teams
Manage org-level agent teams — list available teams, sync agent definitions to a project, or design a new team composition. Use when the user says "team", "agents", "set up a team", or wants to coordinate multiple specialized agents.