Dependency map

Arguments: $ARGUMENTS

Draw the project's declared dependencies, coloured by risk.

Collect the facts

bash "${CLAUDE_PLUGIN_ROOT}/scripts/deps-collect.sh" <path>

Read-only and always exits 0. It never installs anything - it uses a vulnerability auditor only if one is already on PATH.

Sections in its output:

The colour question - read this before drawing

Upstream's dependency diagram colours packages on a vulnerability-severity scale: green Good, blue Low, yellow Medium, orange High, red Critical. That implies a live vulnerability lookup against a scoring database.

This plugin does not have Mermaid Chart's scoring, and must not pretend to. Two honest modes:

Mode A - an auditor ran (audit_ran yes and severity rows present)

Colour by the highest severity advisory affecting each package, using the auditor's own severity label. Name the auditor in the output: "severities from osv-scanner", "from npm audit".

If a row's severity is unknown (some auditors report an advisory ID without a band), colour it grey and label it "advisory, severity not reported". Do not upgrade an unknown to a guess.

Mode B - no auditor, or it produced nothing (colour_basis staleness_only)

Colour by staleness only, and say so in one plain sentence directly beside the diagram:

No vulnerability auditor was found, so colours show version staleness only - not security risk.

Never emit the severity legend in this mode. A red node that means "two majors behind" while the reader assumes "critical CVE" is worse than no colour at all.

Never invent a severity. This is the single most important rule in this skill: a fabricated "critical" sends someone on a fire drill, and a fabricated "green" tells them they are safe when they may not be.

Draw it

This diagram carries real package names and advisory IDs, which on a private project can name internal or scoped packages. Rendering through the bundled server sends them to mcp.mermaid.ai. Say so before rendering, and offer the local mmdc path instead.

flowchart LR, grouped by ecosystem when there is more than one, with a legend. Hand off to the core /mermaid loop to render.

Scope control, because a full tree is unreadable:

• Direct dependencies only by default. Transitive trees run to hundreds of nodes; say you limited it to direct dependencies and offer to expand a specific branch.
• Above ~40 packages, do not draw them all. Draw everything with an advisory, plus the outdated ones, and summarise the healthy remainder as a single counted node ("+ 62 up-to-date"). Say that you did.
• --prod-only drops dev dependencies. Worth suggesting on a repo with a large dev toolchain.

---
config:
  theme: base
---
flowchart LR
  classDef crit fill:#f8cecc,stroke:#b85450,color:#333
  classDef high fill:#ffe6cc,stroke:#d79b00,color:#333
  classDef med  fill:#fff2cc,stroke:#d6b656,color:#333
  classDef low  fill:#dae8fc,stroke:#6c8ebf,color:#333
  classDef ok   fill:#d5e8d4,stroke:#82b366,color:#333

  app(["my-app"])
  subgraph npm [npm]
    express["express ~4.18.0"]
    leftpad["left-pad ^1.3.0<br/>GHSA-xxxx high"]
  end
  subgraph py [python]
    requests["requests >=2.31.0"]
  end

  app --> express
  app --> leftpad
  app --> requests

  class express ok
  class leftpad high
  class requests ok

Always print with the diagram

1. Which auditor ran, or that none did.
2. Which colour basis is in force - severity or staleness.
3. What was excluded - dev dependencies, transitive packages, packages collapsed into a count.
4. Which manifests were read, since a monorepo has several and you may have covered only one.

Honesty rules

• Say when a manifest could not be parsed. A missing ecosystem is not the same as no dependencies in it.
• A version spec is not an installed version. ^1.3.0 is a range; the lockfile holds the truth. If you did not read a lockfile, say the graph shows declared ranges.
• Do not editorialise about packages. Report advisories; do not add opinions about whether a dependency is a good choice unless asked.
• Never run bun install, npm install, or any auditor that needs a fresh install to improve the data. Report what is available.