Dependency Audit

Cover the supply-chain surface the app-level review does not: what you pulled in (CVEs), what you are about to leak (secrets), and whether the lockfile can be trusted. The audit mode reports; the ci mode wires the same checks into CI so a vulnerable dep or a leaked key blocks the merge instead of reaching production.

Scope boundary: security-audit owns app/API vulnerabilities; git-safety owns secrets already in git history. This skill owns dependencies and pre-commit secret leaks, and the CI gate for both.

Contract

Inputs:

• A repo; mode audit (report, default) or ci (add the gate workflow).

Outputs: