Dependency Audit

Goal

Deliver a dependency audit summary for the package manager this project uses.

In Claude Code with this plugin installed, this skill runs in its own dependency-auditor subagent (read-only, remembers packages the project has chosen to hold back); the report comes back to the main session when it finishes. In other harnesses it runs inline; the steps are the same.

Detect package manager

The package manager is $ARGUMENTS. If it is composer or npm, audit only that manager, and stop and report if its manifest (composer.json or package.json) is missing. If it names any other manager, stop and report that only Composer and npm are supported. If it is empty, inspect the project root:

• composer.json present → Composer (PHP)
• package.json present → npm (JavaScript / TypeScript)
• Both present → audit both, report each section separately
• Neither present → stop and report that the directory is not a Composer or npm project

Run