Runs security and license audits on dependencies, providing actionable reports on vulnerabilities and outdated packages.
Install
mkdir -p .claude/skills/audit-stateford && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12327" && unzip -o skill.zip -d .claude/skills/audit-stateford && rm skill.zipInstalls to .claude/skills/audit-stateford
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Run security and license audits on all workspace dependenciesKey capabilities
- →Check if cargo-audit is installed and install if missing
- →Run security audits on workspace dependencies
- →Check for yanked crates in dependencies
- →Identify outdated dependencies without updating them
- →Generate a dependency audit report
- →List recommended actions based on audit findings
How it works
The skill performs a dependency audit by running cargo-audit for security and yanked crates, and cargo update --dry-run for outdated dependencies, then compiles the findings into a structured report.
Inputs & outputs
When to use audit
- →Security auditing
- →Checking for yanked crates
- →Monitoring dependency updates
- →License compliance checks
About this skill
Dependency Audit
Run security and license audits on the Aion workspace dependencies.
Steps
-
Check if
cargo-auditis installed:cargo audit --version 2>/dev/null || cargo install cargo-audit -
Run security audit:
cd "$CLAUDE_PROJECT_DIR" && cargo audit -
Check for yanked crates:
cd "$CLAUDE_PROJECT_DIR" && cargo audit --deny yanked -
Check for outdated dependencies:
cd "$CLAUDE_PROJECT_DIR" && cargo update --dry-run 2>&1 -
Report findings in this format:
## Dependency Audit Report
### Security Vulnerabilities
- <list of advisories, or "None found">
### Yanked Crates
- <list, or "None">
### Available Updates
- <list of outdated deps with current → latest versions>
### Recommended Actions
- <numbered list, or "All clear — no action needed">
Notes
- Do NOT automatically update dependencies. Report findings for the user to decide.
- If
cargo-auditinstallation fails, report the error and suggest manual installation. - Focus on actionable findings — skip informational notices unless they affect this project.
When not to use it
- →When the user wants to automatically update dependencies
- →When only informational notices are needed
- →When the project is not a Rust project
Limitations
- →Does NOT automatically update dependencies
- →Requires cargo-audit to be installed or installable
- →Focuses on actionable findings
How it compares
This skill automates a complete dependency audit and presents findings in a clear report, which is more thorough and less error-prone than manually checking each dependency.
Compared to similar skills
audit side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| audit (this skill) | 0 | 6mo | Review | Beginner |
| security-audit | 0 | 2mo | No flags | Advanced |
| substrate-vulnerability-scanner | 1 | 2mo | Review | Advanced |
| building-vulnerability-aging-and-sla-tracking | 0 | 2mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
security-audit
hiroshiyui
Perform a project-wide security and safety audit of the 5thPlanet workspace.
substrate-vulnerability-scanner
trailofbits
Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.
building-vulnerability-aging-and-sla-tracking
MustafaKemal0146
Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against severity-based timelines and drive accountability.
security-snapshot
MDGrey33
Run the full security analysis pipeline — AWS Inspector V2 + GitHub security alerts → correlation → dashboard. Saves dated snapshots for trend tracking. Run monthly or on demand. Optional --deploy flag pushes the dashboard to Google Apps Script at the end.
deps
matteocervelli
Audit dependency freshness — scan outdated deps and CVEs, classify severity, record update/defer/skip decisions in Atrium, gate PASS/WARN/FAIL. Use when checking for outdated packages or deciding whether to upgrade. Trigger on "outdated dependencies", "dependency audit", "are my deps up to date", "s
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.