The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes package manager commands such as npm audit, pnpm audit, and yarn audit to identify security vulnerabilities in project dependencies.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute several community-standard developer tools from the npm registry, including npm-check-updates, depcheck, package-phobia, and bundlephobia-cli.
[INDIRECT_PROMPT_INJECTION]: The skill involves auditing external project files like package.json and lock files. While these files are processed by standard tools, they represent an entry point for untrusted data into the agent's workflow.
Ingestion points: Project manifest files (package.json) and lock files (package-lock.json, pnpm-lock.yaml, yarn.lock).
Boundary markers: None specified; relies on the default behavior of the CLI tools.
Capability inventory: Capability to install/update packages (npm install, npm update) and execute code via npx.
Sanitization: Relies on the security auditing and validation logic inherent in the provided npm/yarn/pnpm tools.

dependency-auditor