Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub ยท Developer Tools
dep-audit
Audit project dependencies for known vulnerabilities (CVEs). Supports npm, pip, Cargo, and Go. Zero API keys required. Safe-by-default: report-only mode, fix...
skill openclawclawhub Free
Audit project dependencies for known vulnerabilities (CVEs). Supports npm, pip, Cargo, and Go. Zero API keys required. Safe-by-default: report-only mode, fix...
โฌ 0 downloads โ
0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- CHANGELOG.md, README.md, SECURITY.md, SKILL.md, SPEC.md, TESTING.md
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 0.2.1
Provenance
- Publisher
- tkuehnl
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Dependency Audit Skill
Detect and report known vulnerabilities in your project's dependency tree. Supports npm, pip (Python), Cargo (Rust), and Go out of the box. No API keys. No config. Just point it at a project.
Activation
This skill activates when the user mentions: "audit", "vulnerability", "CVE", "dependency check", "supply chain", "security scan" Checking dependencies, lockfiles, or packages for issues Generating an SBOM (Software Bill of Materials)
Example Prompts
"Audit this project for vulnerabilities" "Check all my repos in ~/projects for known CVEs" "Are there any critical vulnerabilities I should fix right now?" "Generate an SBOM for this project" "What dependencies need updating in this project?" "Audit only the Python dependencies"
Permissions
permissions: exec: true # Required to run audit CLIs read: true # Read lockfiles write: on-request # SBOM generation writes sbom.cdx.json when user asks network: true # Tools fetch advisory DBs
Agent Workflow
Follow this sequence exactly:
Step 1: Detect
Run the detection script to discover lockfiles and available tools: bash <skill_dir>/scripts/detect.sh <target_directory> If no target directory is given, use the current working directory (.). Parse the JSON output. Note which ecosystems have lockfiles and which tools are available.
Step 2: Audit Each Ecosystem
For each ecosystem detected in Step 1: If the audit tool is available, run the corresponding script: bash <skill_dir>/scripts/audit-npm.sh <directory> bash <skill_dir>/scripts/audit-pip.sh <directory> bash <skill_dir>/scripts/audit-cargo.sh <directory> bash <skill_dir>/scripts/audit-go.sh <directory> If the tool is missing, tell the user which tool is needed and the install command from the detect output. Skip that ecosystem and continue with others. Note: yarn.lock and pnpm-lock.yaml are detected as yarn and pnpm ecosystems respectively. Audit support is npm-only in v0.1.x (package-lock.json). If only a yarn.lock or pnpm-lock.yaml is present, inform the user that dedicated yarn/pnpm audit is not yet supported and suggest running yarn audit or pnpm audit manually. Each script outputs normalized JSON to stdout.
Step 3: Aggregate
Pipe or pass all per-ecosystem JSON results to the aggregator: bash <skill_dir>/scripts/aggregate.sh <npm_result.json> <pip_result.json> ... 1>unified.json 2>report.md The aggregator outputs unified JSON to stdout and a Markdown report to stderr. Capture both: 2>report.md for the Markdown, 1>unified.json for the JSON.
Step 4: Present Results
Show the user the Markdown report from the aggregator. Highlight: Total vulnerability count by severity Critical and High findings first (these need attention) Which ecosystems were scanned vs skipped If zero vulnerabilities found: report "โ No known vulnerabilities found." If no lockfiles found: report "No lockfiles found in <dir>. This skill works with npm, pip, Cargo, and Go projects."
Discord v2 Delivery Mode (OpenClaw v2026.2.14+)
When the user is in a Discord channel: Send a short first response with totals and only Critical/High findings. Keep the first message under ~1200 characters and avoid large Markdown tables up front. If Discord components are available, include quick actions: Show Full Report Show Fix Commands Generate SBOM If components are unavailable, provide the same options as a numbered list. Send long details in short chunks (<=15 lines) to improve readability.
Step 5: Fix Suggestions (only if user asks)
If the user asks to fix vulnerabilities: List every fix command with the package name, current version, and target version. Suggest creating a branch first: git checkout -b dep-audit-fixes Ask for explicit confirmation before running ANY fix command. Never batch-run fix commands silently. Example interaction: I found these fix commands: 1. cd /home/user/project && npm audit fix 2. pip install requests>=2.31.0 I recommend creating a branch first: git checkout -b dep-audit-fixes Shall I run them? (yes/no)
Step 6: SBOM (only if user asks)
bash <skill_dir>/scripts/sbom.sh <directory> Report the file location and component count.
Error Handling
SituationBehaviorTool not foundPrint which tool is missing + install command. Continue with available tools.Audit tool failsCapture stderr, report "audit failed for [ecosystem]: [error]". Continue with others.Timeout (>30s per tool)When timeout/gtimeout is available, report "audit timed out for [ecosystem], skipping". Continue.Invalid target directoryReport "directory not found or not accessible" and stop that ecosystem scan (do not report false "clean").No lockfiles foundReport "No lockfiles found" + list supported ecosystems.jq not availableDetection works without jq. Audit and aggregation require jq โ install it first.Malformed lockfileReport parse error for that ecosystem. Continue with others.
Aggregation Robustness
aggregate.sh now tolerates mixed inputs (valid results + error objects). Invalid input objects are listed under errors in unified JSON and rendered in a "Skipped / Error Inputs" Markdown section. If no valid ecosystem results are provided, aggregate output sets status: "error" instead of crashing.
Safety
Default mode is report-only. The skill never modifies files unless you explicitly ask for a fix and confirm. Audit tools read lockfiles โ they do not execute project code. Fix commands (npm audit fix, pip install --upgrade) are printed as suggestions. The agent will ask for confirmation before running them. This skill checks known advisory databases (OSV, GitHub Advisory DB, RustSec). It does not detect zero-days or runtime vulnerabilities. No data is sent to third-party services beyond what the native audit tools do (they query public advisory databases). No telemetry. No tracking. No phone-home.
Category context
Code helpers, APIs, CLIs, browser automation, testing, and developer operations.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
6 Docs
- SKILL.md
- CHANGELOG.md
- README.md
- SECURITY.md
- SPEC.md
- TESTING.md