How Claude Code /deps-check Finds CVEs Before They Hit Production

Every week, security researchers publish new CVEs. Every week, production systems get breached because someone didn't update a dependency in time. The gap between "vulnerability disclosed" and "team patches it" is where most supply chain attacks live. The problem isn't that developers don't care — it's that manual dependency auditing is slow, noisy, and easy to skip under deadline pressure. This is where /deps-check , a custom Claude Code skill from the Security Pack, changes the workflow. How /deps-check Works /deps-check scans your project's dependency manifests ( package.json , requirements.txt , Cargo.toml , go.mod ) and cross-references each package version against known CVE databases (NVD, OSV, GitHub Advisory Database). Unlike raw npm audit output, /deps-check adds an AI-assisted triage layer: Severity scoring in context : It considers whether your code actually calls the vulnerable function, not just whether the package is installed. Fix priority ranking : Critical vulnerabilit