> ## Documentation Index
> Fetch the complete documentation index at: https://docs.talosjs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# security:check

> Audit dependency lockfiles and assistant configuration for security findings

Audits resolved dependencies through OSV.dev and scans assistant instruction files unless you disable that scan. It prints findings grouped by module, or writes one YAML issue per finding.

## Usage

```bash theme={null}
talos security:check [options]
```

## Examples

Audit every discovered target:

```bash theme={null}
talos security:check
```

Audit only named modules:

```bash theme={null}
talos security:check --modules=user,billing
```

Report only high and critical findings:

```bash theme={null}
talos security:check --audit-level=high
```

Create local issue YAML files instead of printing the report:

```bash theme={null}
talos security:check --issues
```

Skip the assistant configuration audit:

```bash theme={null}
talos security:check --skip-llm
```

## Options

| Option          | Description                                                               | Default                |
| --------------- | ------------------------------------------------------------------------- | ---------------------- |
| `--issues`      | Create a YAML issue per finding instead of printing the report.           | `false`                |
| `--modules`     | Only audit modules whose directory name matches the comma-separated list. | All discovered targets |
| `--packages`    | Alias for `--modules`.                                                    | All discovered targets |
| `--audit-level` | Minimum severity to report: `low`, `moderate`, `high`, or `critical`.     | `unknown`              |
| `--skip-llm`    | Skip the assistant configuration audit.                                   | `false`                |
| `--cwd`         | Working directory.                                                        | Current directory      |

## Dependency audit

The command walks the workspace, skipping dependency and build-output directories, and audits directories that contain supported lockfiles. It reads `bun.lock`, `package-lock.json`, `go.sum`, `Gemfile.lock`, and `composer.lock`.

Dependency findings come from `https://api.osv.dev/v1/querybatch` and `https://api.osv.dev/v1/vulns`. Findings include the package, version, severity, advisory id, aliases, patched versions when available, and the OSV URL.

## Assistant audit

Unless `--skip-llm` is set, the command scans assistant agent, skill, rule, prompt, instruction, and MCP files. Findings from this scan include the assistant name, file and line, rule id, severity, evidence, remediation, and reference URL.

## Issues

With `--issues`, the command writes one `Todo` issue per finding. Findings in the project root are written under `modules/shared/issues`; other findings are written under the owning module or package `issues/` directory. All created issues are labeled `Security`.

## Output

The default report prints a `Security audit` header, grouped findings, and a severity summary. If nothing is found, it prints `No known vulnerabilities found`.