agentleFS
Sign inStart free
blessonismblessonism/openclaw-skills/dependency-tracker/SKILL.md

dependency-tracker

Skill55 starsChanged 9 months agoMITView on GitHub

Track and check updates for all OpenClaw dependencies: managed skills (GitHub/ClewHub), bundled skills, workspace skills, npm packages, pip packages, and CLI tools. Use when user asks "check for updates", "dependency status", "are my skills up to date", "什么需要更新", "检查依赖", "检查更新", or wants a dependency health report. Triggers on: dependency check, skill updates, outdated packages, version drift.

The file

We split this skill into the rules it gives an agent

10 rules. About 0 are common, 5 are distinctive, and 5 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈5

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 5

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    All scripts are in the skill directory: ~/.openclaw/workspace/skills/dependency-tracker/scripts/

    line 28
  2. Distinctive:

    When user asks to check dependencies:

    line 47
  3. Very specific:

    Run scan.py to refresh the manifest

    line 49
  4. Very specific:

    Run check.py to compare against remote sources

    line 50
  5. Very specific:

    Run report.py to generate the report

    line 51
  6. Distinctive:

    If unknown-source skills found, notify Boss

    line 53
  7. Distinctive:

    Run all three scripts in sequence

    line 58
  8. Distinctive:

    Only notify if updates are found or errors occur

    line 60
  9. Very specific:

    All runtime data lives in data/ (gitignored from backup):

    line 64
  10. Distinctive:

    No auto-update: Only detect and report. User decides when to update.

    line 76

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Dependency Tracker

Track version drift across all OpenClaw dependencies. Detect updates, generate reports, notify Boss.

Quick Start

# 1. Scan — build/refresh the local manifest
python3 scripts/scan.py

# 2. Check — compare local vs remote versions
python3 scripts/check.py

# 3. Report — generate human-readable Markdown report
python3 scripts/report.py

All scripts are in the skill directory: ~/.openclaw/workspace/skills/dependency-tracker/scripts/

What It Tracks

CategorySourceDetection Method
Managed skills (GitHub).skill-lock.jsonGitHub Contents API (git hash compare)
Managed skills (ClewHub)_meta.jsonClewHub API (version compare)
Bundled skills/app/skills/Tied to OpenClaw version
Workspace skillsworkspace/skills/Local git (self-managed)
OpenClaw versionnpm registry + GitHubnpm view / GitHub Releases API
npm dependencies/app/node_modules/npm outdated
pip packagessystem Pythonpip3 list --outdated
CLI toolsPATHVersion commands

Workflow

On-Demand Check

When user asks to check dependencies:

  1. Run scan.py to refresh the manifest
  2. Run check.py to compare against remote sources
  3. Run report.py to generate the report
  4. Send report summary to user (Telegram)
  5. If unknown-source skills found, notify Boss

Scheduled Check (Cron)

Set up a weekly cron job:

  • Run all three scripts in sequence
  • Push report summary to Telegram
  • Only notify if updates are found or errors occur

Data Files

All runtime data lives in data/ (gitignored from backup):

data/
├── manifest.json        # Full dependency inventory
├── check-results.json   # Latest check results
└── reports/
    └── YYYY-MM-DD-report.md  # Generated reports

Key Design Decisions

  • No auto-update: Only detect and report. User decides when to update.
  • GitHub hash comparison: Uses git hash-object locally vs GitHub Contents API SHA — exact match, no false positives.
  • Lock file as source of truth: .skill-lock.json (OpenClaw's managed skill registry) provides repo URLs and install metadata.
  • Changelog extraction: For GitHub skills with updates, fetches recent commits for context.
  • Unknown source notification: Skills without traceable source are flagged and reported to Boss.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free