Audit Dependencies

Overview

A four-step dependency audit that goes past npm audit / pip-audit / cargo audit output into the actual import graph. The skill enforces that every claim ("we don't use that import path", "this dep is dead", "this CVE doesn't apply") is backed by evidence from the code, not from a tool's verdict alone. The audit produces a list of dependencies with three columns: declared, transitively pulled, actually called. Anything in column 1 or 2 but not column 3 is a candidate for removal. Anything called but unpinned, deprecated, or vulnerable is an action item. Senior ICs use it before adding a new dep, before a major version bump, or after a CVE lands.

When to Use