1. Habit
  2. Skills
  3. Audit Dependencies skill
payloadcms · 127 installs

Audit Dependencies skill
Runs by itself, audit check fails.

Vulnerable dependencies fixed the simplest way.

Install the Audit Dependencies skill and make it a habit: follow https://gethabit.dev/skills/payloadcms/audit-dependencies.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

127 installs45K starsMIT licenceSource on GitHub ↗

Audit Dependencies

by payloadcms · 127 installs

The skill

The audit dependencies skill helps pnpm monorepo maintainers fix vulnerabilities from pnpm audit the simplest way: direct bump, lockfile update, or a justified override, then a PR with advisory links.

Only when you ask.

The habit

Vulnerable dependencies fixed the simplest way.

↻ Runs by itselfaudit check fails

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

audit check fails. Runs in GitHub Actions or Claude Code routine.

  • ↻ audit check fails
  • audit-dependencies CI check fails, or weekly schedule

02

It checks its work

you approve, audit exits 0. If a check fails, it stops.

  • ✓./.github/workflows/audit-dependencies.sh exits 0 after fixes
  • ✓pnpm run build:core passes
  • ✓every override uses a ^ range and has a justification
  • ✓each fixed vulnerability has a GHSA link in the PR

03

It remembers

fix(deps) commits. The next run reads it first: earlier overrides and why they were needed.

loops/audit-dependencies-loop/run-log.md

One run, step by step.
Then it stops.

Stop ruleStops after one PR per run; no fixes are applied without your confirmation.

  1. 01

    Run the audit

    Run ./.github/workflows/audit-dependencies.sh with the severity, default high.

  2. 02

    Trace chains

    Mark each package direct or transitive and walk up to the nearest one you control.

  3. 03

    Pick a fix

    Prefer a direct bump, then pnpm update --recursive, then a scoped pnpm override.

  4. 04

    Show the plan

    Present a table of fixes and reasons and wait for your confirmation.

  5. 05

    Install and verify

    Run pnpm install, re-run the audit script and pnpm run build:core.

  6. 06

    Look up advisories

    Record GHSA ID, CVE ID, severity and a one-line description per fix.

  7. 07

    Open the PR

    Commit as fix(deps) and open a PR with gh pr create.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Audit Dependencies skill helps.

Use it when

  • ✓ pnpm audit reports vulnerabilities
  • ✓ The audit CI check fails
  • ✓ You need to justify a pnpm override

Skip it when

  • – You use npm or yarn
  • – You want automatic merges

Questions

Audit Dependencies skill, answered.

Why not just add overrides?

The skill treats overrides as the last step, used only when a bump or lockfile update cannot work.

What if install fails on native builds?

The skill falls back to pnpm install --ignore-scripts.

How do I install the Audit Dependencies skill?

Copy the prompt at the top into your agent. It installs the skill from payloadcms/payload and sets up the habit. Or run npx skills add payloadcms/payload --skill audit-dependencies.

Is the Audit Dependencies skill free?

Yes. It is published under MIT. Habit is free too.

Audit Dependencies. Now as a habit.

Install the Audit Dependencies skill and make it a habit: follow https://gethabit.dev/skills/payloadcms/audit-dependencies.md

  • Free
  • No account
  • Undo in one line

All payloadcms skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by payloadcms, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.