# Dependency Audit · shipshitdev

> Audit a project's dependency supply chain — known CVEs in installed packages, secrets about to be committed, and lockfile/provenance integrity — and wire the checks into CI as a merge gate. Use when asked to audit dependencies, check for vulnerable packages, scan for leaked secrets, add a security gate to CI, or harden the supply chain. Complements security-audit (app-level) and git-safety (git history).

## Facts
- Page: https://tashan.sh/capability/skill-shipshitdev-dependency-audit
- tashan id: skill:shipshitdev/dependency-audit
- Source: https://github.com/shipshitdev/skills
- Type: skill
- Category: security
- tashan score: 50.0 / 100
- Adoption: 14.0
- Upkeep: 98.0
- Freshness: 95.0
- Evidence coverage: 84% of the inputs this score can use
- Health: active
- Instruction depth: not yet graded
- Official: no

## Install

```sh
cp -r dependency-audit ~/.claude/skills/
```

## Security audit
Not scanned. We audit npm-published capabilities; this one has no npm package we can resolve, or has not reached the queue. This is not a clean bill of health.

---
Measured 2026-09-12 by tashan (https://tashan.sh) from public evidence. Scorer s5.