dep-audit

SUSPICIOUS. The core audit purpose is legitimate and most fallback audit commands align with dependency scanning, but the skill is over-broad for that purpose: it permits arbitrary bash, executes project-local scripts, and may fetch/run third-party code via npx yarn-audit-fix. Data flows mostly go to expected package ecosystems, yet install/execution trust and scope proportionality are weaker than a narrowly scoped audit skill should require.