B. Quality, Speed & Resilience · Prompt 19

Dependency & Supply Chain Risk

Get the free PDF

Why it matters

You can review every line you wrote and still ship a bug that lives in a package you did not write.

Modeled on

OWASP Dependency-Check and npm audit, which report known vulnerabilities in dependencies.

How to run this prompt

Switch to a mode that does not edit files. In Cursor that is Ask or Plan. In Claude Code that is Plan mode.
Paste the audit prompt. Wait for the report. It must stop and ask which IDs to fix.
Read the report. Keep the IDs you agree with.
Switch to a mode that can edit. Paste the fix prompt and the IDs you chose.
Switch back to the read-only mode and paste the same audit prompt again. Confirm those IDs are gone.

Cursor: audit in Ask mode or Plan mode. Fix in Agent mode.
Claude Code: audit in Plan mode (Shift+Tab cycles to it). Fix in Normal mode, which can edit.
Any other tool: audit in Chat, Discuss, or Plan mode, whichever answers without editing files. If the tool has no such mode, the prompt itself forbids edits. Fix in the mode that is allowed to edit files.

The audit prompt

MODE: AUDIT ONLY. Do not create, edit, or delete any file. Do not run commands
that change anything: no installs, migrations, git commits, deploys, or "--fix" flags.
If your tool has an Ask, Plan, Chat, or Discuss mode, use it for this prompt.

Before you start:
- Tell me the stack you detect (framework, language, database, auth, hosting,
  payment provider) and which folders you will review.
- If a check below does not apply to this stack, write "Not applicable" and why.
- If you can run read-only commands, run the ones listed. If you cannot, list them
  so I can run them and paste the output.

Dependency & Supply Chain Risk: what to check
Audit third-party dependencies. You may run read-only commands such as npm audit --omit=dev, npm ls, or the equivalent for this package manager. Do not run npm audit fix, yarn upgrade, or any command that edits the lockfile.
1. List dependencies with a known high or critical advisory at the installed version, from the audit command output. If the command fails, paste the error and stop that check.
2. Flag packages that look abandoned: no release for about two years, or a repository that says it is unmaintained. Say how you checked. If you only guessed from the name, mark it unconfirmed.
3. Flag install scripts (postinstall, preinstall) and packages that ask for broad permissions. Cite package.json.
4. Flag two libraries that do the same job (for example two date libraries).
5. Flag git URLs, file: paths, or tags that are not a registry version pinned in the lockfile.
6. Flag a license that may conflict with selling or closing the source (for example GPL) if the license field says so. Do not give legal advice. Say "confirm with a lawyer" when a license is unusual.
7. For each finding, give severity, the installed version, and either a safer version from the advisory or "no fixed version listed".
8. Do not upgrade anything in this pass.

Evidence rules:
- Every finding cites a file path and line number, or the exact command output used.
- Mark each finding Confirmed (seen in the code) or Needs manual check (depends on
  something outside the repo, such as a dashboard setting or production data).
- Never print a full secret. Show the first 4 characters and the location only.
- If you are not sure, say so. Do not invent files, settings, or results.

Severity: Critical = exploitable now, or leaks real data or money. High = serious
with little effort. Medium = weakens defenses or needs a second bug. Low = hygiene.

Report:
- Summary: count of findings by severity.
- Table: ID | Severity | Confirmed? | Finding | Evidence | Why it matters | Suggested fix | Effort
  (IDs for this prompt use the prefix P19, for example P19-1, P19-2.)
- Checked and fine: what you verified is already OK.
- Could not check: what I need to look at myself, and where.

Then stop. Do not fix anything. Ask me which IDs I want fixed.

Get the free PDF

Related prompts

Share this prompt

WhatsApp LinkedIn X

How to run this prompt

Switch to a mode that does not edit files. In Cursor that is Ask or Plan. In Claude Code that is Plan mode.

Paste the audit prompt. Wait for the report. It must stop and ask which IDs to fix.

Read the report. Keep the IDs you agree with.

Switch to a mode that can edit. Paste the fix prompt and the IDs you chose.

Switch back to the read-only mode and paste the same audit prompt again. Confirm those IDs are gone.

Cursor: audit in Ask mode or Plan mode. Fix in Agent mode.

Claude Code: audit in Plan mode (Shift+Tab cycles to it). Fix in Normal mode, which can edit.

Any other tool: audit in Chat, Discuss, or Plan mode, whichever answers without editing files. If the tool has no such mode, the prompt itself forbids edits. Fix in the mode that is allowed to edit files.

The audit prompt

MODE: AUDIT ONLY. Do not create, edit, or delete any file. Do not run commands that change anything: no installs, migrations, git commits, deploys, or "--fix" flags. If your tool has an Ask, Plan, Chat, or Discuss mode, use it for this prompt. Before you start: - Tell me the stack you detect (framework, language, database, auth, hosting, payment provider) and which folders you will review. - If a check below does not apply to this stack, write "Not applicable" and why. - If you can run read-only commands, run the ones listed. If you cannot, list them so I can run them and paste the output. Dependency & Supply Chain Risk: what to check Audit third-party dependencies. You may run read-only commands such as npm audit --omit=dev, npm ls, or the equivalent for this package manager. Do not run npm audit fix, yarn upgrade, or any command that edits the lockfile. 1. List dependencies with a known high or critical advisory at the installed version, from the audit command output. If the command fails, paste the error and stop that check. 2. Flag packages that look abandoned: no release for about two years, or a repository that says it is unmaintained. Say how you checked. If you only guessed from the name, mark it unconfirmed. 3. Flag install scripts (postinstall, preinstall) and packages that ask for broad permissions. Cite package.json. 4. Flag two libraries that do the same job (for example two date libraries). 5. Flag git URLs, file: paths, or tags that are not a registry version pinned in the lockfile. 6. Flag a license that may conflict with selling or closing the source (for example GPL) if the license field says so. Do not give legal advice. Say "confirm with a lawyer" when a license is unusual. 7. For each finding, give severity, the installed version, and either a safer version from the advisory or "no fixed version listed". 8. Do not upgrade anything in this pass. Evidence rules: - Every finding cites a file path and line number, or the exact command output used. - Mark each finding Confirmed (seen in the code) or Needs manual check (depends on something outside the repo, such as a dashboard setting or production data). - Never print a full secret. Show the first 4 characters and the location only. - If you are not sure, say so. Do not invent files, settings, or results. Severity: Critical = exploitable now, or leaks real data or money. High = serious with little effort. Medium = weakens defenses or needs a second bug. Low = hygiene. Report: - Summary: count of findings by severity. - Table: ID | Severity | Confirmed? | Finding | Evidence | Why it matters | Suggested fix | Effort (IDs for this prompt use the prefix P19, for example P19-1, P19-2.) - Checked and fine: what you verified is already OK. - Could not check: what I need to look at myself, and where. Then stop. Do not fix anything. Ask me which IDs I want fixed.