Skip to main content
Audits resolved dependencies through OSV.dev and scans assistant instruction files unless you disable that scan. It prints findings grouped by module, or writes one YAML issue per finding.

​
Usage

​
Examples

Audit every discovered target:
Audit only named modules:
Report only high and critical findings:
Create local issue YAML files instead of printing the report:
Skip the assistant configuration audit:

​
Options

​
Dependency audit

The command walks the workspace, skipping dependency and build-output directories, and audits directories that contain supported lockfiles. It reads bun.lock, package-lock.json, go.sum, Gemfile.lock, and composer.lock. Dependency findings come from https://api.osv.dev/v1/querybatch and https://api.osv.dev/v1/vulns. Findings include the package, version, severity, advisory id, aliases, patched versions when available, and the OSV URL.

​
Assistant audit

Unless --skip-llm is set, the command scans assistant agent, skill, rule, prompt, instruction, and MCP files. Findings from this scan include the assistant name, file and line, rule id, severity, evidence, remediation, and reference URL.

​
Issues

With --issues, the command writes one Todo issue per finding. Findings in the project root are written under modules/shared/issues; other findings are written under the owning module or package issues/ directory. All created issues are labeled Security.

​
Output

The default report prints a Security audit header, grouped findings, and a severity summary. If nothing is found, it prints No known vulnerabilities found.