jpmschweitzerandClaude Opus 4.6
7158ae9cf5
Claude-native starter kit that bootstraps multi-agent team infrastructure for any project. Clone once, install as a global skill, run /kit-install in any project directory. Includes: - 3-tier profile system (minimal/standard/full: 3-12 agents) - 16 agent archetype templates with personality spectrum - 18 skill templates using domain-action naming convention - Stakeholder persona panel for workshops and PR reviews - SQLite ticketing DB with CLI tools (config-based DB paths) - Decision tracking, sprint lifecycle, workshop orchestration - Multi-git-host support (GitHub, Gitea, GitLab) - /kit-update skill for syncing with source repo evolution - Naming theme support for agent identity/flavor - Smoke tests for all three profile tiers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
name, description, user-invocable, allowed-tools
| name | description | user-invocable | allowed-tools |
|---|---|---|---|
| dep-audit | Audit project dependencies for vulnerabilities and outdated packages. Use when the user says "audit dependencies", "security scan", "check deps", or invokes /dep-audit. Detects package manager and runs appropriate audit commands. | true | Bash, Read, Grep, Glob, Write, AskUserQuestion |
Dependency Audit
Audit project dependencies for vulnerabilities and outdated packages across all detected package managers.
Workflow
1. Detect Package Managers
Check for the presence of these files at the project root:
| File | Ecosystem | Audit Command | Outdated Command |
|---|---|---|---|
Cargo.toml |
Rust | cargo audit |
cargo outdated |
package.json |
Node.js | npm audit |
npm outdated |
pyproject.toml / requirements.txt |
Python | pip-audit |
pip list --outdated |
go.mod |
Go | govulncheck ./... |
go list -m -u all |
Gemfile |
Ruby | bundle audit |
bundle outdated |
2. Run Audits
Execute the appropriate audit and outdated commands for each detected package manager. Capture both stdout and stderr — some tools report findings on stderr.
If a required audit tool is not installed, note it in the output rather than failing.
3. Aggregate Findings
Combine results across all ecosystems:
- Vulnerabilities: grouped by severity (Critical / High / Medium / Low)
- Outdated packages: with current version, latest version, and update type
4. Risk Assessment
For each finding, assess:
- Severity: as reported by the audit tool
- Effort to fix: patch update (low), minor update (medium), major version bump (high)
- Dependency type: direct dependency vs. transitive — direct dependencies are higher priority
5. Output
Write the audit report:
## Dependency Audit — {date}
### Vulnerabilities
| Package | Severity | Description | Fix Available |
|---------|----------|-------------|---------------|
### Outdated
| Package | Current | Latest | Type (major/minor/patch) |
|---------|---------|--------|--------------------------|
### Summary
Critical: N | High: N | Medium: N | Low: N
Outdated: N packages (M with breaking changes)
### Recommended Actions
1. {Prioritized action items with effort estimates}
6. Optional: Create Tickets
Ask the user (via AskUserQuestion) if they want to create tickets for critical or high-severity findings. If yes, create tickets using the project's ticket CLI.