Dependency Audit

Runs ecosystem-appropriate dependency audit commands and produces a normalized supply-chain signal. Independent of code review — produces a separate, parallel signal that callers (build, quality-gate, user) integrate as they choose.

Announce at start: "Running dependency audit on [project path]."

Skill type: Rigid — follow exactly, no shortcuts.

When to Use

• Build pipeline: Invoked in parallel with quality-gate on code-artifact phases. Both produce independent signals; build's gate ledger integrates them.
• Standalone: User runs /dependency-audit directly to scan a project ad-hoc.
• CI / scheduled runs: Invoked by a cron-style schedule to catch dependency drift between feature work.

Skill Arguments

skip_blocking (boolean, default: false) — Global override. When true, disables ALL blocking regardless of min_blocking_severity. Findings are still reported in audit-results.md but no blocking occurs and the result is FINDINGS (not BLOCKED). skip_blocking supersedes min_blocking_severity entirely — they do not interact as independent thresholds.