# Send dep-audit to your agent Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually. ## Fast path - Download the package from Yavira. - Extract it into a folder your agent can access. - Paste one of the prompts below and point your agent at the extracted folder. ## Suggested prompts ### New install ```text I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete. ``` ### Upgrade existing ```text I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run. ``` ## Machine-readable fields ```json { "schemaVersion": "1.0", "item": { "slug": "dep-audit", "name": "dep-audit", "source": "tencent", "type": "skill", "category": "开发工具", "sourceUrl": "https://clawhub.ai/tkuehnl/dep-audit", "canonicalUrl": "https://clawhub.ai/tkuehnl/dep-audit", "targetPlatform": "OpenClaw" }, "install": { "downloadUrl": "/downloads/dep-audit", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=dep-audit", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "packageFormat": "ZIP package", "primaryDoc": "SKILL.md", "includedAssets": [ "CHANGELOG.md", "README.md", "SECURITY.md", "SKILL.md", "SPEC.md", "TESTING.md" ], "downloadMode": "redirect", "sourceHealth": { "source": "tencent", "slug": "dep-audit", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-05-11T22:22:36.134Z", "expiresAt": "2026-05-18T22:22:36.134Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=dep-audit", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=dep-audit", "contentDisposition": "attachment; filename=\"dep-audit-0.2.1.zip\"", "redirectLocation": null, "bodySnippet": null, "slug": "dep-audit" }, "scope": "item", "summary": "Item download looks usable.", "detail": "Yavira can redirect you to the upstream package for this item.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/dep-audit" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] } }, "links": { "detailUrl": "https://openagent3.xyz/skills/dep-audit", "downloadUrl": "https://openagent3.xyz/downloads/dep-audit", "agentUrl": "https://openagent3.xyz/skills/dep-audit/agent", "manifestUrl": "https://openagent3.xyz/skills/dep-audit/agent.json", "briefUrl": "https://openagent3.xyz/skills/dep-audit/agent.md" } } ``` ## Documentation ### Dependency Audit Skill Detect and report known vulnerabilities in your project's dependency tree. Supports npm, pip (Python), Cargo (Rust), and Go out of the box. No API keys. No config. Just point it at a project. ### Activation This skill activates when the user mentions: "audit", "vulnerability", "CVE", "dependency check", "supply chain", "security scan" Checking dependencies, lockfiles, or packages for issues Generating an SBOM (Software Bill of Materials) ### Example Prompts "Audit this project for vulnerabilities" "Check all my repos in ~/projects for known CVEs" "Are there any critical vulnerabilities I should fix right now?" "Generate an SBOM for this project" "What dependencies need updating in this project?" "Audit only the Python dependencies" ### Permissions permissions: exec: true # Required to run audit CLIs read: true # Read lockfiles write: on-request # SBOM generation writes sbom.cdx.json when user asks network: true # Tools fetch advisory DBs ### Agent Workflow Follow this sequence exactly: ### Step 1: Detect Run the detection script to discover lockfiles and available tools: bash /scripts/detect.sh If no target directory is given, use the current working directory (.). Parse the JSON output. Note which ecosystems have lockfiles and which tools are available. ### Step 2: Audit Each Ecosystem For each ecosystem detected in Step 1: If the audit tool is available, run the corresponding script: bash /scripts/audit-npm.sh bash /scripts/audit-pip.sh bash /scripts/audit-cargo.sh bash /scripts/audit-go.sh If the tool is missing, tell the user which tool is needed and the install command from the detect output. Skip that ecosystem and continue with others. Note: yarn.lock and pnpm-lock.yaml are detected as yarn and pnpm ecosystems respectively. Audit support is npm-only in v0.1.x (package-lock.json). If only a yarn.lock or pnpm-lock.yaml is present, inform the user that dedicated yarn/pnpm audit is not yet supported and suggest running yarn audit or pnpm audit manually. Each script outputs normalized JSON to stdout. ### Step 3: Aggregate Pipe or pass all per-ecosystem JSON results to the aggregator: bash /scripts/aggregate.sh ... 1>unified.json 2>report.md The aggregator outputs unified JSON to stdout and a Markdown report to stderr. Capture both: 2>report.md for the Markdown, 1>unified.json for the JSON. ### Step 4: Present Results Show the user the Markdown report from the aggregator. Highlight: Total vulnerability count by severity Critical and High findings first (these need attention) Which ecosystems were scanned vs skipped If zero vulnerabilities found: report "✅ No known vulnerabilities found." If no lockfiles found: report "No lockfiles found in . This skill works with npm, pip, Cargo, and Go projects." ### Discord v2 Delivery Mode (OpenClaw v2026.2.14+) When the user is in a Discord channel: Send a short first response with totals and only Critical/High findings. Keep the first message under ~1200 characters and avoid large Markdown tables up front. If Discord components are available, include quick actions: Show Full Report Show Fix Commands Generate SBOM If components are unavailable, provide the same options as a numbered list. Send long details in short chunks (<=15 lines) to improve readability. ### Step 5: Fix Suggestions (only if user asks) If the user asks to fix vulnerabilities: List every fix command with the package name, current version, and target version. Suggest creating a branch first: git checkout -b dep-audit-fixes Ask for explicit confirmation before running ANY fix command. Never batch-run fix commands silently. Example interaction: I found these fix commands: 1. cd /home/user/project && npm audit fix 2. pip install requests>=2.31.0 I recommend creating a branch first: git checkout -b dep-audit-fixes Shall I run them? (yes/no) ### Step 6: SBOM (only if user asks) bash /scripts/sbom.sh Report the file location and component count. ### Error Handling SituationBehaviorTool not foundPrint which tool is missing + install command. Continue with available tools.Audit tool failsCapture stderr, report "audit failed for [ecosystem]: [error]". Continue with others.Timeout (>30s per tool)When timeout/gtimeout is available, report "audit timed out for [ecosystem], skipping". Continue.Invalid target directoryReport "directory not found or not accessible" and stop that ecosystem scan (do not report false "clean").No lockfiles foundReport "No lockfiles found" + list supported ecosystems.jq not availableDetection works without jq. Audit and aggregation require jq — install it first.Malformed lockfileReport parse error for that ecosystem. Continue with others. ### Aggregation Robustness aggregate.sh now tolerates mixed inputs (valid results + error objects). Invalid input objects are listed under errors in unified JSON and rendered in a "Skipped / Error Inputs" Markdown section. If no valid ecosystem results are provided, aggregate output sets status: "error" instead of crashing. ### Safety Default mode is report-only. The skill never modifies files unless you explicitly ask for a fix and confirm. Audit tools read lockfiles — they do not execute project code. Fix commands (npm audit fix, pip install --upgrade) are printed as suggestions. The agent will ask for confirmation before running them. This skill checks known advisory databases (OSV, GitHub Advisory DB, RustSec). It does not detect zero-days or runtime vulnerabilities. No data is sent to third-party services beyond what the native audit tools do (they query public advisory databases). No telemetry. No tracking. No phone-home. ## Trust - Source: tencent - Verification: Indexed source record - Publisher: tkuehnl - Version: 0.2.1 ## Source health - Status: healthy - Item download looks usable. - Yavira can redirect you to the upstream package for this item. - Health scope: item - Reason: direct_download_ok - Checked at: 2026-05-11T22:22:36.134Z - Expires at: 2026-05-18T22:22:36.134Z - Recommended action: Download for OpenClaw ## Links - [Detail page](https://openagent3.xyz/skills/dep-audit) - [Send to Agent page](https://openagent3.xyz/skills/dep-audit/agent) - [JSON manifest](https://openagent3.xyz/skills/dep-audit/agent.json) - [Markdown brief](https://openagent3.xyz/skills/dep-audit/agent.md) - [Download page](https://openagent3.xyz/downloads/dep-audit)