CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
Dependency audit and cleanup workflow for maintaining healthy project dependencies.
Install Dependency Audit
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install bobmatnyc/claude-mpm dependency-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .claude/skills/dependency-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .claude/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install bobmatnyc/claude-mpm dependency-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .agents/skills/dependency-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .agents/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install bobmatnyc/claude-mpm dependency-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .cursor/skills/dependency-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .cursor/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/bobmatnyc/claude-mpm.git --path plugin/skills/toolchains-universal-dependency-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install bobmatnyc/claude-mpm dependency-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .gemini/skills/dependency-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .gemini/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install bobmatnyc/claude-mpm dependency-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .github/skills/dependency-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .github/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install bobmatnyc/claude-mpm dependency-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/bobmatnyc/claude-mpm.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugin/skills/toolchains-universal-dependency-audit .opencode/skills/dependency-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "dependency-audit" agent skill from https://github.com/bobmatnyc/claude-mpm/tree/main/plugin/skills/toolchains-universal-dependency-audit into .opencode/skills/dependency-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dependency-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
dependency-audit- GitHub stars
- 155
- Token cost
- ~3.5k tokens
- SKILL.md length
- 303 words
- Files
- 3
- Skills in repo
- 52
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Dependency audit and cleanup workflow for maintaining healthy project dependencies.
- Works in 8 steps: Check Outdated Packages → Security Vulnerability Scan → Find Unused Dependencies → …
- Regular maintenance
- SKILL.md covers Summary, When to Use, Quick Audit Process and Audit Commands, plus 5 more sections
- Calls pnpm, npm and yarn; needs SNYK_TOKEN
What it does
Dependency Audit is an agent skill from bobmatnyc/claude-mpm. Dependency audit and cleanup workflow for maintaining healthy project dependencies. Use for regular maintenance, security updates, and removing unused packages.
Its SKILL.md is about 3.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `.etag_cache.json` and `metadata.json`).
It sits in Security. It works with JavaScript, TypeScript and Python. The repository describes itself as: Claude Multi-Agent Project Manager — multi-channel orchestration, GitHub-first SDK mode, and plugin system for Claude.
When your agent uses it
- Regular maintenance
- Security updates
- Removing unused packages
Example prompts
- “/dependency-audit”
Requirements
- Python 3
- Node.js
- A credential in SNYK_TOKEN
Workflow steps
8 steps, taken from the step headings in SKILL.md.
- Check Outdated Packages
- Security Vulnerability Scan
- Find Unused Dependencies
- Identify Unused Dependencies
- Verify Not Used
- Remove Package
- Update Lock File
- Test
What it can do on your machine
Read from SKILL.md and the folder at commit 25203d3. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
pnpmnpmyarnpoetrypipgitrgnpx
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use pnpm, npm, yarn, pip, git and npx, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
SNYK_TOKEN
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Dependency Audit loads about 3.5k tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 303 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 303 words (~3,460 tokens).
“Systematic workflow for auditing, updating, and cleaning up project dependencies. Covers security vulnerability scanning, outdated package detection, unused dependency removal, and migration from deprecated libraries.”
- name
- dependency-audit
- progressive_disclosure.entry_point
- summary, when_to_use, quick_audit_process
- progressive_disclosure.sections
- audit_commands, priority_matrix, common_replacements, update_strategy, cleanup_workflow, security_scanning
Files
SKILL.md and 2 other files in plugin/skills/toolchains-universal-dependency-audit of bobmatnyc/claude-mpm.
- SKILL.md
- .etag_cache.json
- metadata.json
Open the folder on GitHubat commit 25203d3
Compare with similar skills
Dependency Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Dependency Audit this skillbobmatnyc/claude-mpm | 155 | — | ~3.5k | Automated safety check: Pass | Custom licence | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Openai Security Best Practicestrailofbits/skills-curated | 512 | 9 repos | ~2.2k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Secure Code Guidancenightly-labs/openbot | 453 | — | ~369 | Automated safety check: Pass | Custom licence | |
| Code Review ChecklistshareAI-lab/learn-claude-code | 78k | 5 repos | ~1.1k | Automated safety check: Pass | MIT | |
| Gemini API Devgoogle-gemini/gemini-skills | 4.3k | — | ~5.1k | Automated safety check: Pass | Apache-2.0 |
Similar skills
- Official
- Official
Openai Security Best Practices
trailofbits/skills-curated
Perform language and framework specific security best-practice reviews and suggest improvements.
Secure Code Guidance
nightly-labs/openbot
Review or write Python, JavaScript, TypeScript, or Go code using secure defaults.
Code Review Checklist
shareAI-lab/learn-claude-code
Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.
- Official
Gemini API Dev
google-gemini/gemini-skills
A skill your agent uses when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, speech generation (TTS), voice…
jscpd Code Migration Tracker
kucherenko/jscpd
Measures a code port between languages or frameworks with jscpd's function-level comparison, porting tests before code and tracking what is left unmatched.
More from bobmatnyc/claude-mpm
All 52 skills in this repoBuild MCP Server
bobmatnyc/claude-mpm
Create high-quality MCP servers that enable LLMs to effectively interact with external services.
Env Manager
bobmatnyc/claude-mpm
Environment variable validation, synchronization, and management across local development, CI/CD, and deployment platforms
Session Analyzer
bobmatnyc/claude-mpm
Debug and teach agentic coding: a deterministic-first session timeline + cost report, with optional narrative polish and a standalone JSX visualiser.
Software Patterns
bobmatnyc/claude-mpm
Decision framework for architectural patterns including DI, SOA, Repository, Domain Events, Circuit Breaker, and Anti-Corruption Layer.
Verification Before Completion
bobmatnyc/claude-mpm
Run verification commands and confirm output before claiming success
Migration Wizard
bobmatnyc/claude-mpm
General protocol for executing migration skill wizards - service installation and configuration guides
Related
Works with
Categories
Questions about Dependency Audit
What does Dependency Audit do?
Dependency audit and cleanup workflow for maintaining healthy project dependencies. Dependency Audit is an agent skill from bobmatnyc/claude-mpm. Dependency audit and cleanup workflow for maintaining healthy project dependencies.
When should I use Dependency Audit?
Dependency Audit fits situations like: regular maintenance; security updates; removing unused packages.
How do I install Dependency Audit in Claude Code?
Run `npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a claude-code`. Or copy the skill folder (plugin/skills/toolchains-universal-dependency-audit in bobmatnyc/claude-mpm) into .claude/skills/dependency-audit in your project. Claude Code loads it when a task matches its description.
How do I install Dependency Audit in Codex?
Run `npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a codex`. Or copy the skill folder (plugin/skills/toolchains-universal-dependency-audit in bobmatnyc/claude-mpm) into .agents/skills/dependency-audit in your project. Codex loads it when a task matches its description.
Can I use Dependency Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add bobmatnyc/claude-mpm --skill dependency-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dependency-audit, .gemini/skills/dependency-audit, .github/skills/dependency-audit and .opencode/skills/dependency-audit in your project.
What does Dependency Audit need to run?
Going by SKILL.md and its folder, Dependency Audit needs the command-line tools its instructions call (pnpm, npm, yarn, poetry, pip and git) and credentials named SNYK_TOKEN. Our summary lists: Python 3; Node.js; A credential in SNYK_TOKEN.
Does Dependency Audit access the network?
SKILL.md contains no URLs. Its commands use npm, pip, git and npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Dependency Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Dependency Audit use?
Dependency Audit has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Dependency Audit use?
About 3.5k tokens (SKILL.md is roughly 14k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Dependency Audit?
Skills that share tags, products or a category with Dependency Audit: CodeQL Security Scan (trailofbits/skills, 7.4k stars), Openai Security Best Practices (trailofbits/skills-curated, 512 stars), Secure Code Guidance (nightly-labs/openbot, 453 stars) and Code Review Checklist (shareAI-lab/learn-claude-code, 78k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Dependency Audit?
bobmatnyc (a GitHub user) maintains it in bobmatnyc/claude-mpm, which has 155 GitHub stars. The repository holds 52 skills in this directory. The repository was last updated on August 31, 2026.
Source: bobmatnyc/claude-mpm on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.