---
name: nuget-audit
description: Audit NuGet dependencies for vulnerabilities, deprecated packages, and outdated versions across the solution. Use when the user asks about package health, security vulnerabilities in dependencies, or updating packages.
allowed-tools: Bash(dotnet list *), Bash(dotnet restore*), Bash(dotnet add *), Bash(dotnet build*), Read, Grep, Glob
---

# NuGet Dependency Audit

1. Restore first so metadata is current: `dotnet restore`
2. Gather three views of the solution:
   - `dotnet list package --vulnerable --include-transitive`
   - `dotnet list package --deprecated`
   - `dotnet list package --outdated`
3. Produce a report table: **Package | Current | Status (vulnerable/deprecated/outdated) | Severity/Advisory | Recommended version | Breaking-change risk**.
4. Prioritize: vulnerabilities (by severity) → deprecated → major-version-behind → minor/patch.
5. For each vulnerable package, state whether the vulnerable code path is plausibly reachable from this codebase (grep for usage) — don't just list CVEs.
6. Propose an upgrade plan in safe batches (patch/minor first). Only run `dotnet add package` upgrades the user approves, one batch at a time, building and running tests between batches.
7. Flag transitive-only vulnerabilities separately and recommend either a direct pin or upstream bump.