home / skills / openclaw / skills / ai-audit-fix

ai-audit-fix skill

safe

This skill analyzes npm audit output and provides prioritized, actionable fix commands to address vulnerabilities in production code.

npx playbooks add skill openclaw/skills --skill ai-audit-fix

Review the files below or copy the command above to add this skill to your agents.

Files (2)

SKILL.md

2.6 KB

---
name: audit-fixer
description: Analyze npm audit output with AI and get actionable fix suggestions. Use when dealing with security vulnerabilities.
---

# Audit Fixer

npm audit shows 47 vulnerabilities. Half are in nested dependencies you can't control. This tool analyzes your audit results and gives you actionable fixes. Which ones matter, which to ignore, and exactly what to do about each.

**One command. Zero config. Just works.**

## Quick Start

```bash
npm audit --json | npx ai-audit-fix
```

## What It Does

- Analyzes npm audit output and prioritizes by real risk
- Identifies which vulnerabilities actually affect your code
- Provides specific fix commands for each issue
- Explains when to override vs when to actually fix
- Distinguishes between dev and production dependencies

## Usage Examples

```bash
# Pipe audit output directly
npm audit --json | npx ai-audit-fix

# Analyze from a saved file
npx ai-audit-fix --input audit-results.json

# Only show high and critical issues
npm audit --json | npx ai-audit-fix --severity high,critical

# Get fix commands only
npm audit --json | npx ai-audit-fix --fixes-only
```

## Best Practices

- **Focus on production deps first** - Dev dependencies don't ship to users
- **Check if vulnerable code is actually called** - Many vulnerabilities are in code paths you never use
- **Update parent packages first** - Often fixes multiple nested vulnerabilities at once
- **Use overrides carefully** - Document why you're overriding and set a reminder to revisit

## When to Use This

- npm audit shows a wall of red and you don't know where to start
- CI is failing on security checks
- Need to report on vulnerabilities to a security team
- Deciding whether to delay a release for security fixes

## Part of the LXGIC Dev Toolkit

This is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work.

**Find more:**
- GitHub: https://github.com/LXGIC-Studios
- Twitter: https://x.com/lxgicstudios
- Substack: https://lxgicstudios.substack.com
- Website: https://lxgicstudios.com

## Requirements

No install needed. Just run with npx. Node.js 18+ recommended.

```bash
npx ai-audit-fix --help
```

## How It Works

The tool parses npm audit JSON output, analyzes each vulnerability's dependency chain and severity, determines if it affects your production code, then generates prioritized recommendations with specific fix commands.

## License

MIT. Free forever. Use it however you want.

---

**Built by LXGIC Studios**

- GitHub: [github.com/lxgicstudios/ai-audit-fix](https://github.com/lxgicstudios/ai-audit-fix)
- Twitter: [@lxgicstudios](https://x.com/lxgicstudios)

Overview

This skill analyzes npm audit JSON output and returns prioritized, actionable fixes for vulnerabilities. It separates real risks from noise, explains impact on your code, and provides exact commands to remediate or safely override issues. Use it to turn audit noise into a clear remediation plan.

How this skill works

The skill parses npm audit JSON and inspects each vulnerability’s dependency chain, severity, and whether the affected code is reachable from production code paths. It prioritizes issues by real risk, distinguishes dev vs production dependencies, and generates specific fix commands or suggested overrides. It also explains when a vulnerability can be ignored and when to escalate.

When to use it

npm audit outputs many vulnerabilities and you don’t know where to start
CI fails due to security checks and you need a fast remediation plan
Preparing a vulnerability report for a security or engineering review
Deciding whether to delay a release to address security issues
You want exact commands to update, patch, or override problematic packages

Best practices

Focus on production dependencies before dev dependencies
Attempt parent-package updates first to fix nested issues in bulk
Verify whether vulnerable code paths are actually used in your project
Document any overrides and schedule follow-ups to re-evaluate them
Prefer explicit, minimal commands that can be run in CI or locally

Example use cases

Pipe npm audit JSON into the tool to get prioritized fixes and commands
Analyze saved audit results from CI to generate a remediation checklist for a release
Filter results by severity to focus on high and critical issues before a sprint
Generate fix-only output to run automated update scripts in CI
Create a concise report for security teams with impact analysis and recommended actions

FAQ

Do I need to install anything to run this?

No install required. The tool runs via npx and works with npm audit --json output. Node.js 18+ is recommended.

Will it automatically modify my package.json or lockfile?

No. The skill only provides recommended commands and guidance. You decide which fixes to run and when to apply them.