Security Auditor Skill

Run structured security audits with actionable remediation plans.

Trigger Phrases

• •"npm audit"
• •"security vulnerability"
• •"dependency vulnerability"
• •"CVE"
• •"security check"
• •"audit dependencies"
• •"check vulnerabilities"

Description

This skill performs comprehensive security audits on npm projects, parsing vulnerability data and generating actionable remediation plans with prioritized fixes.

Capabilities

• •Execute npm audit --json and parse structured output
• •Classify vulnerabilities by severity (critical, high, medium, low)
• •Extract CVE identifiers, affected versions, and fix versions
• •Distinguish direct vs transitive dependencies
• •Generate markdown reports with remediation commands
• •Support risk acceptance via security-exceptions.json
• •Provide CI-friendly exit codes

Usage

Basic Audit

npx tsx scripts/index.ts

JSON Output

npx tsx scripts/index.ts --json

Fail on High+ Severity (for CI)

npx tsx scripts/index.ts --fail-on high

Fail on Critical Only

npx tsx scripts/index.ts --fail-on critical

Risk Acceptance

Create a security-exceptions.json file in your project root to accept known risks:

{
  "exceptions": [
    {
      "id": "GHSA-xxxx-xxxx-xxxx",
      "reason": "Not exploitable in our usage context",
      "expires": "2025-06-01",
      "approvedBy": "security-team"
    }
  ]
}

Exit Codes

• •0 - No vulnerabilities above threshold
• •1 - Vulnerabilities found above threshold (with --fail-on)
• •2 - Error running audit

Requirements

• •Node.js and npm installed
• •Valid package.json in target directory
• •Optional: package-lock.json for accurate audit