Dependency Check
- 659 installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
dependency-check is a Claude Code skill that scans npm project dependencies for known CVEs and outdated packages so developers can block risky merges and deployments.
About
dependency-check is a security skill in ruvnet/ruflo that audits third-party packages before merge or deploy using Claude Flow CLI and npm audit. It runs commands such as `npx @claude-flow/cli@latest security cve --list`, `security cve --severity critical`, `security scan --type deps --depth deep`, and `npm audit --json`, then maps findings to severity-driven actions like blocking critical issues. Developers reach for dependency-check after lockfile changes, `npm install`, release prep, or when investigating a published CVE advisory. The skill accepts an optional `--path` argument, stores results via `mcp__claude-flow__memory_store`, and is designed for agent workflows that must validate supply-chain risk without manual CLI scripting.
- Scans package manifests and lockfiles for known vulnerabilities
- Outputs severity-rated dependency risk reports
- Integrates directly into agentic coding workflows
- Supports multiple languages and ecosystems via unified CLI
- Hard-gate: run before any production deployment or agent publish
Dependency Check by the numbers
- 659 all-time installs (skills.sh)
- +7 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #578 of 2,153 Testing & QA skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill dependency-checkAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 659 |
|---|---|
| repo stars | ★ 67k |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you scan npm deps for CVEs before deploy?
Automatically scan and report on vulnerable or outdated dependencies before merging code or deploying agents.
Who is it for?
Developers and release engineers who need automated npm dependency CVE checks tied to merge and deploy gates.
Skip if: Teams on non-npm ecosystems without adaptation, or projects that only need static code analysis without package auditing.
When should I use this skill?
Lockfiles change, npm install runs, a CVE advisory is reported, or the user asks to audit dependencies before release.
What you get
CVE severity report, outdated package list, npm audit JSON, and merge or deploy block recommendations.
- CVE severity report
- npm audit JSON output
- deploy block recommendations
Files
Check dependencies for CVEs and outdated packages:
npx @claude-flow/cli@latest security cve --list
npx @claude-flow/cli@latest security cve --severity critical
npx @claude-flow/cli@latest security scan --type deps --depth deep
npm audit --json| Severity | Action |
|---|---|
| critical | Block deployment, fix immediately |
| high | Fix before next release |
| moderate | Schedule fix within sprint |
| low | Track in backlog |
Auto-fix via the scan command: npx @claude-flow/cli@latest security scan --type deps --fix
For continuous monitoring, dispatch via MCP: mcp__claude-flow__hooks_worker-dispatch({ trigger: "audit" })
Related skills
TddFollow test-driven development with a strict red-green-refactor loop when creating reliable features or fixing bugs.544k196k
Test Driven DevelopmentEnforce writing failing tests before any production implementation code.181k264kQaRun conversational QA sessions that turn user-reported bugs into well-written, domain-aware GitHub issues without manual ticket writing.179k196kMigrate To ShoehornAutomatically update TypeScript test files that rely on unsafe `as` type assertions by replacing them with type-safe partial objects from @total-typescript/shoehorn.164k196k
Webapp TestingVerify frontend behavior, debug UI issues, capture screenshots, and inspect logs of a running local web application using Playwright.123k165k
Playwright CliRun browser automation, generate element snapshots, inspect DOM attributes, and execute Playwright tests from the terminal.102k12.3kHow it compares
Pick dependency-check when the goal is package-level CVE and lockfile auditing rather than full-repo secret or misconfiguration scanning.
FAQ
What commands does dependency-check run?
dependency-check invokes Claude Flow CLI security commands such as `security cve --list`, `security cve --severity critical`, and `security scan --type deps --depth deep`, plus `npm audit --json` for npm-native vulnerability data.
When should dependency-check run in CI?
dependency-check should run after lockfile or `npm install` changes, before merges, and ahead of production deploys when investigating reported CVE advisories or validating third-party package risk.